php - Re-issueing a token -

in form, have token saved in session , must present when form submitted:

$token = hash('sha256', rand() . microtime() . $_server['remote_addr']) // rand possible $_server['token'] = $token; 

now in form have hidden value:

<input type="hidden" name="token" value="<?php echo $token;?>"> 

when form submitted check whether matches token in session:

if ($_post['token'] !== $_session['token']) { // show error here } else { //carry on } 

however, happens if user fills in form incorrectly? can't change token again in session because output has been sent. suggest?

i suggest not send output long not ready headers, sessions , on. can produce output @ end of request, or (if first solution not possible) @ manual "output buffering".