title: How to prevent form replay/man-in-the-middle attack in PHP, csrf, xsrf
body: <p>I have a web form and I'm using PHP. I'm aware that forms can be manipulated (I believe it's called replay attack or a man-in-the-middle attack). So I'd like to use some authenticity token as a hidden field. </p>
  
  <p>The threat possibilities that I'm aware of are:</p>
  
  <ul>
  <li>Attacker hijacks the legitimate user's form (this I believe is the man-in-the-middle attack)</li>
  <li>the legitimate user is himself the attacker: he gets the form, reads the token but uses it to send dangerous data (this I believe is the replay attack)</li>
  </ul>
  
  <p>Before I get to the questions, please correct me if anything I said so far is incorrect, because maybe my understanding is flawed.</p>
  
  <p>Now to the questions: </p>
  
  <ul>
  <li>What is the best practice to generate this token so that the form without it gets rejected (for example, salting?). </li>
  <li>What do people do to make sure that the token isn't being replayed.</li>
  </ul>
  
  <p>New small questions based on comments:</p>
  
  <ul>
  <li>Is session hijacking the same as man-in-the-middle attack?</li>
  </ul>