PHP:使用存储为cookie的令牌防止会话劫持？

ini_set('session.cookie_httponly', 1);
ini_set('session.cookie_secure', 1);

<?php
session_start();
$csrf_token = bin2hex(random_bytes(32));
$_SESSION['csrf_token'] = $csrf_token;
?>

<form action="submit.php" method="post">
 <input type="hidden" name="csrf_token" value="<?php echo $csrf_token; ?>">
  <!-- 其他表单元素 -->
 <input type="submit" value="提交">
</form>

<?php
session_start();

if (isset($_POST['csrf_token']) && hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
  // 处理表单数据
} else {
  // 显示错误消息
}
?>

<?php
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "myDB";

// 创建连接
$conn = new mysqli($servername, $username, $password, $dbname);

// 检查连接
if ($conn->connect_error) {
  die("连接失败: " . $conn->connect_error);
}

// 设置字符集
$conn->set_charset("utf8");
?>