<p>Maybe try <code>craft()-&gt;request-&gt;getCsrfToken()</code>, see if that does it?</p>

<p><strong>Edit</strong></p>

<p>Sorry, misunderstood the question, since you are saying your plugin has a CP section then i'm assuming you're actually looking for a twig way to output the CSRF input, not so much a PHP way. To output the CRSF input in your template simply do <code>{{ getCsrfInput() }}</code></p>

CC BY-SA 3.0
2015-05-28T20:11:48.713Z
Thank you, that works, in conjunction with `<input type='hidden' name="CRAFT_CSRF_TOKEN" value='{craft()->request->getCsrfToken()}'>`
kr37
CC BY-SA 3.0
2015-05-28T15:15:40.450Z
2015-05-28T19:55:18.770Z
2015-05-28T19:55:18.770Z
Alec Ritson
<p>My plugin has a tab in the CP. On that tab is a form. What's the way for PHP to generate a CSRF token that can be output to the form with echo?</p>

<p><strong>EDIT to document the final answer</strong></p>

<pre><code>$token = craft()-&gt;request-&gt;getCsrfToken();
$out .= &lt;&lt;&lt;MYFORM
   &lt;form action="#" method="post"&gt;
      &lt;input type='hidden' name="CRAFT_CSRF_TOKEN" value='$token'&gt;
      ...
   &lt;/form&gt;
MYFORM;
return $out;
</code></pre>

<p>And make sure that /craft/config/general.php includes this:</p>

<pre><code>return array(
       'enableCsrfProtection' =&gt; true,
);
</code></pre>

CC BY-SA 3.0
2015-05-28T18:55:34.853Z
Definitely don't use `echo`. If you want to pass data back to your Twig template, there are several other (much better) ways to do it. Most of the time you'll want to use a Variable defined by your plugin.
Lindsey D
CC BY-SA 3.0
2015-05-28T20:20:21.800Z
@LindseyD Yes, sorry, I'm doing that, I think.
kr37
<plugin-development><csrf>
In a plugin, what's the way in PHP to output a CSRF token?
# In a plugin, what's the way in PHP to output a CSRF token?

(Asked by: username_0 on 2015-05-28)

My plugin has a tab in the CP. On that tab is a form. What's the way for PHP to generate a CSRF token that can be output to the form with echo?
EDIT to document the final answer
$token = craft()->request->getCsrfToken();
$out .= <<
      
      ...
   
MYFORM;
return $out;

And make sure that /craft/config/general.php includes this:
return array(
       'enableCsrfProtection' => true,
);

**Tags:** plugin-development, csrf
> **Comments:**
> **username_1**: Definitely don't use `echo`. If you want to pass data back to your Twig template, there are several other (much better) ways to do it. Most of the time you'll want to use a Variable defined by your plugin.  
> **username_0**: @LindseyD Yes, sorry, I'm doing that, I think.  

---

## 1 answers

### Answer by username_2 on 2015-05-28. Score: 2 | Accepted answer

Maybe try `craft()->request->getCsrfToken()`, see if that does it?

**Edit**

Sorry, misunderstood the question, since you are saying your plugin has a CP section then i'm assuming you're actually looking for a twig way to output the CSRF input, not so much a PHP way. To output the CRSF input in your template simply do `{{ getCsrfInput() }}`

> **Comments:**
> **username_0**: Thank you, that works, in conjunction with `<input type='hidden' name="CRAFT_CSRF_TOKEN" value='{craft()->request->getCsrfToken()}'>`  

---

