CVE-2023-40172: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. A Cross-site request forgery (CSRF) attack is a type of malicious attack whereby an attacker tricks a victim into performing an action on a website that they do not intend to do. This can be done by sending the victim a malicious link or by exploiting a vulnerability in the website. Prior to version 1.0.5 Social media skeleton did not properly restrict CSRF attacks. This has been addressed in version 1.0.5 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2023-08-18T22:15Z
Repository: https://github.com/fobybus/social-media-skeleton
Language: PHP
Files changed: admin/adminlogin.html, admin/atask/add.php, admin/atask/setting.php, admin/home.php, admin/login.php, admin/mg.php, login.php, tasks/passw.php, user/home.js, user/setting.html, user/setting.php
Commit date: 2023-08-15 10:26:56 -0700
Commit message: fixed csrf bug,improved admin/atask/setting.php and added passw.php

Diff: diff --git a/admin/adminlogin.html b/admin/adminlogin.html
index 69c8ffb..2ea34e5 100644
--- a/admin/adminlogin.html
+++ b/admin/adminlogin.html
@@ -35,13 +35,13 @@
 		<div class="loginbox">
 			<form action="login.php" method="post">
 				<fieldset id="field1">
 					<legend>admin login</legend>
 					EMAIL:<br>
-					<input class="inputf" type="email" name="email"> <br>
+					<input class="inputf" type="email" name="email" required> <br>
 					PASSWORD:<br>
-					<input class="inputf" type="password" name="password">
+					<input class="inputf" type="password" name="password" required>
 					<br>
 					<input class="buf" type="submit" value="login"><br>
 				</fieldset>
 			</form>
 			<hr>
diff --git a/admin/atask/add.html b/admin/atask/add.html
deleted file mode 100644
index 9c6cbbb..0000000
--- a/admin/atask/add.html
+++ /dev/null
@@ -1,53 +0,0 @@
-
-<html lang="en-us">
-
-    <head>
-        <title> admin homepage </title>
-        <meta charset="utf-8">
-        <meta name="viewport" content="width=device-width,intial-scale=1.0">
-        <meta name="keywords"
-            content="social media,the best social media platform,chat with your friend ,easy social media,pipago">
-        <meta name="description" content="light weight secured student's social media!!!">
-        <meta name="author" content="black eagle team">
-        <link rel="stylesheet" href="../home.css">
-    </head>
-    <!-- body goes here -->
-    
-    <body>
-        <!--header-->
-        <header>
-            <!-- -navigation links-->
-            <nav>
-    
-                <ul>
-                    <li><a href="../home.php">pipa analytics</a></li>
-                    <li><a href="../mg.php" >manage user </a></li>
-                    <li><a href="#" style="background-color: black;"> add admin </a></li>
-                    <li><a href="setting.php">setting</a></li>
-                    <li><a href="logout.php">logout</a></li>
-                </ul>
-    
-            </nav>
-    
-        </header>
-        <!-- content-->
-        <main>
-      <div class="addbox">
-    <form class="adform" action="add.php" method="POST">
-    <label>email</label><br>
-    <input type="email" name="email"><br>
-    <label>password</label><br>
-    <input type="password" name="password">
-    <input class="addbutton" type="submit" value="add">
-    </form>
-    
-      </div>
-        </main>
-        <!--footer content-->
-        <footer>
-    
-    
-        </footer>
-    </body>
-    
-    </html>
\ No newline at end of file
diff --git a/admin/atask/add.php b/admin/atask/add.php
index 8f8f7d4..a6bfb73 100644
--- a/admin/atask/add.php
+++ b/admin/atask/add.php
@@ -1,41 +1,114 @@
 
 <?php
+require("../../tasks/passw.php");
 session_start();
 if(!isset($_SESSION["aid"]))
 {
-	header("location:adminlogin.html");
+	header("location:../adminlogin.html");
    exit();
 }
-$uemail=htmlspecialchars($_POST["email"], ENT_QUOTES, 'UTF-8');
-$upass=htmlspecialchars($_POST["password"], ENT_QUOTES, 'UTF-8');
 
-//if empty password or username!
-//alt isempty
-if($uemail=="" || $upass=="")
+if($_SERVER['REQUEST_METHOD'] == 'POST')
 {
-  header("location:add.html");
-  exit();
-}
-require("../../tasks/condb.php");
-
-// Create a prepared statement to prevent SQL injection
-$query = "INSERT INTO admin (email, password) VALUES (?, ?)";
-$stmt = mysqli_prepare($dbcon, $query);
-mysqli_stmt_bind_param($stmt, "ss", $uemail, $upass);
-$result = mysqli_stmt_execute($stmt);
+  $uemail=htmlspecialchars($_POST["email"], ENT_QUOTES, 'UTF-8');
+  $upass=$_POST["password"];
 
-if($result)
-{
-  echo("<p style='color:green;position:absolute;left:250px;top:70px'> successfully added $uemail</p>");
- include("add.html");
+     //check token 
+     if(isset($_SESSION["c-token"]) && isset($_POST["csrf-token"]))
+     {
+       $tok=$_POST["csrf-token"];
+       if($_SESSION["c-token"]!=$tok)
+       {
+         exit("action denied!");
+       }
+     } else {
+         exit("action denied!");
+     }
+    
+  //if empty password or username!
+  //alt isempty
+  if($uemail=="" || $upass=="")
+  {
+    header("location:add.php");
+    exit();
+  }
+  require("../../tasks/condb.php");
+  
+  // Create a prepared statement to prevent SQL injection
+  $query = "INSERT INTO admin (email, password) VALUES (?, ?)";
+  $stmt = mysqli_prepare($dbcon, $query);
+  mysqli_stmt_bind_param($stmt, "ss", $uemail, $upass);
+  $result = mysqli_stmt_execute($stmt);
+  
+  if($result)
+  {
+    echo("<p style='color:green;position:absolute;left:250px;top:70px'> successfully added $uemail</p>");
+    $dbcon->close();
+  }  else {
+  echo("some thing want wrong please try again!");
   $dbcon->close();
-  exit();
-}  else {
-echo("some thing want wrong please try again!");
-$dbcon->close();
-include("add.html");
+  }
 }
 
-
+//gen ctoken
+$tok=$_SESSION["c-token"]=generateSalt();
 
 ?>
+
+
+
+
+
+<html lang="en-us">
+
+    <head>
+        <title> admin homepage </title>
+        <meta charset="utf-8">
+        <meta name="viewport" content="width=device-width,initial-scale=1.0">
+        <meta name="keywords"
+            content="social media,the best social media platform,chat with your friend ,easy social media,pipago">
+        <meta name="description" content="light weight secured student's social media!!!">
+        <meta name="author" content="black eagle team">
+        <link rel="stylesheet" href="../home.css">
+    </head>
+    <!-- body goes here -->
+    
+    <body>
+        <!--header-->
+        <header>
+            <!-- -navigation links-->
+            <nav>
+    
+                <ul>
+                    <li><a href="../home.php">pipa analytics</a></li>
+                    <li><a href="../mg.php" >manage user </a></li>
+                    <li><a href="#" style="background-color: black;"> add admin </a></li>
+                    <li><a href="setting.php">setting</a></li>
+                    <li><a href="logout.php">logout</a></li>
+                </ul>
+    
+            </nav>
+    
+        </header>
+        <!-- content-->
+        <main>
+      <div class="addbox">
+    <form class="adform" action="add.php" method="POST">
+    <label>email</label><br>
+    <input type="email" name="email" required><br>
+    <label>password</label><br>
+    <input type="password" name="password" required>
+    <input type="text" name="csrf-token" value="<?php echo $tok; ?>" hidden>
+    <input class="addbutton" type="submit" value="add">
+    </form>
+    
+      </div>
+        </main>
+        <!--footer content-->
+        <footer>
+    
+    
+        </footer>
+    </body>
+    
+    </html>
\ No newline at end of file
diff --git a/admin/atask/setting.php b/admin/atask/setting.php
index db4f5f5..e433267 100644
--- a/admin/atask/setting.php
+++ b/admin/atask/setting.php
@@ -16,45 +16,43 @@ if($_SERVER['REQUEST_METHOD'] == 'POST')
 	$pchanged=false;
 	$gotold=false;
 	$putold=false;
 
 	//is email changed 
-	if(isset($_POST['email']))
+	if(isset($_POST['email']) && $_POST['email']!="")
 	{
 	$echanged=true;
 	$newemail=htmlspecialchars($_POST['email'], ENT_QUOTES, 'UTF-8');
 	} 
 	//is pass ^^
-	if(isset($_POST['password']))
+	if(isset($_POST['password']) && $_POST['password']!="")
 	{
 	$pchanged=true;
-	$newpass=htmlspecialchars($_POST['password'], ENT_QUOTES, 'UTF-8');
+	$newpass=$_POST['password'];
 	} 
-	if(isset($_POST['oldpass']))
+	if(isset($_POST['oldpass']) && $_POST['oldpass']!="")
 	{
 		$putold=true;
-		$oldpass=htmlspecialchars($_POST['oldpass'], ENT_QUOTES, 'UTF-8');
+		$oldpass=$_POST['oldpass'];
 		
 	}
 /*************************************************** */
-// SQLi prevention through parameterization
-$id = $_SESSION["aid"];
-$q = "SELECT * FROM admin WHERE admin_id=?";
-$stmt = mysqli_prepare($dbcon, $q);
-mysqli_stmt_bind_param($stmt, "i", $id);
-mysqli_stmt_execute($stmt);
-$result = mysqli_stmt_get_result($stmt);
-$row = $result->fetch_assoc(); 
-$rpass = $row["password"];  //real
+$id=$_SESSION["aid"];
+$rpass = $_SESSION["password"];  //actual pass
 
 if ($pchanged && $oldpass == $rpass) {
     // change the password 
     $q = "UPDATE admin SET password=? WHERE admin_id=?";
     $stmt = mysqli_prepare($dbcon, $q);
     mysqli_stmt_bind_param($stmt, "si", $newpass, $id);
     mysqli_stmt_execute($stmt);
+	$_SESSION["password"]=$newpass;
     echo "changed the password <br>";
+} 
+
+if (($pchanged && $oldpass != $rpass) || ($echanged && $oldpass != $rpass)) {
+    echo "incorrect attempt! <br>";
 }  
 
 if ($echanged && $oldpass == $rpass) {
     $q = "UPDATE admin SET email=? WHERE admin_id=?";
     $stmt = mysqli_prepare($dbcon, $q);
@@ -62,10 +60,11 @@ if ($echanged && $oldpass == $rpass) {
     mysqli_stmt_execute($stmt);
     echo "changed the email <br>";
 }
 /***************************************************** */
 }
+$dbcon->close();
 ?> 
 
 <html lang="en-us">
 
 <head>
@@ -87,11 +86,11 @@ if ($echanged && $oldpass == $rpass) {
 		<nav>
 
 			<ul>
 				<li><a href="../home.php">pipa analytics</a></li>
 				<li><a href="../mg.php">manage user </a></li>
-				<li><a href="add.html"> add admin </a></li>
+				<li><a href="add.php"> add admin </a></li>
 				<li><a href="#"  style="background-color: black;">setting</a></li>
 				<li><a href="logout.php">logout</a></li>
 			</ul>
 
 		</nav>
@@ -101,13 +100,13 @@ if ($echanged && $oldpass == $rpass) {
 	<main>
     <div class="adminsetting">
     <div class="adminsetting1">
 		<form action="" method="post">
 		<label >email</label><br>
-    <input type="email" name="email" required><br>
+    <input type="email" name="email"  placeholder="unchanged"><br>
 	<label >new password</label><br>
-	<input type="password" name="password" required><br>
+	<input type="password" name="password" placeholder="unchanged"><br>
 	<label >old password</label><br>
 	<input type="password" name="oldpass" required title="old password required to save changes" ><br>
 	<input type="submit" id="submitb" value="save changes">
 </form>
 	</div>
diff --git a/admin/home.php b/admin/home.php
index 1605597..1d6de14 100644
--- a/admin/home.php
+++ b/admin/home.php
@@ -30,11 +30,11 @@ session_start();
 		<nav>
 
 			<ul>
 				<li><a href="#" style="background-color: black;">pipa analytics</a></li>
 				<li><a href="mg.php">manage user </a></li>
-				<li><a href="atask/add.html"> add admin </a></li>
+				<li><a href="atask/add.php"> add admin </a></li>
 				<li><a href="atask/setting.php">setting</a></li>
 				<li><a href="atask/logout.php">logout</a></li>
 			</ul>
 
 		</nav>
diff --git a/admin/login.php b/admin/login.php
index 004bbd9..08fbbed 100644
--- a/admin/login.php
+++ b/admin/login.php
@@ -1,8 +1,8 @@
 <?php
 include("../tasks/condb.php");
-if(!isset($_POST["email"]));
+if(!isset($_POST["email"]))
 header("location:adminlogin.html");
 //handle the form 
 $uemail=$_POST["email"];
 $upass=$_POST["password"];
 
@@ -17,18 +17,16 @@ if($result->num_rows>0)
 {
   $rows=$result->fetch_assoc();
   $id=$rows["admin_id"];
   session_start();
   $_SESSION["aid"]=$id;
-  $dbcon->close();
+  $_SESSION["password"]=$rows["password"];
  header("location:home.php");
-    exit;
 }  else {
-  $dbcon->close();
-    echo "<p style='color:red;text-align:center;font-size:20px;position: absolute;left:700px;top:250px;'> incorrect password or email  </p>";
+    echo "<p style='color:red;text-align:center;font-size:20px;'> incorrect password or email  </p>";
    require('adminlogin.html');
-    exit();
 }
+$dbcon->close();
 
 ?>
 
 
diff --git a/admin/mg.php b/admin/mg.php
index bc412e9..3d082d1 100644
--- a/admin/mg.php
+++ b/admin/mg.php
@@ -35,11 +35,11 @@ if(!isset($_SESSION["aid"]))
         <nav>
 
             <ul>
                 <li><a href="home.php">pipa analytics</a></li>
                 <li><a href="#" style="background-color: black;">manage user </a></li>
-                <li><a href="atask/add.html"> add admin </a></li>
+                <li><a href="atask/add.php"> add admin </a></li>
                 <li><a href="atask/setting.php">setting</a></li>
                 <li><a href="atask/logout.php">logout</a></li>
             </ul>
 
         </nav>
diff --git a/login.php b/login.php
index 129c4bc..248c42d 100644
--- a/login.php
+++ b/login.php
@@ -63,11 +63,11 @@ if($result->num_rows>0)
 $dbcon->close();
   header("location:user/home.php");
     exit;
 }  else {
   $dbcon->close();
-    echo "<p style='color:red;text-align:center;font-size:20px;position: absolute;left:700px;top:250px;'> incorrect password or email  </p>";
+    echo "<p style='color:red;text-align:center;font-size:20px;'> incorrect password or email  </p>";
    require('login.html');
     exit();
 }
 
 ?>
diff --git a/tasks/passw.php b/tasks/passw.php
new file mode 100644
index 0000000..6367d51
--- /dev/null
+++ b/tasks/passw.php
@@ -0,0 +1,17 @@
+<?php
+
+//generate salt 
+function generateSalt()
+{
+  $randb=random_bytes(16);
+  return bin2hex($randb);
+}
+
+//hash password 
+function hashPass($plain,$salt)
+{
+    $password=$plain.$salt;
+    return hash("sha256",$password);
+}
+
+?>
\ No newline at end of file
diff --git a/user/home.js b/user/home.js
index 82830e5..de3b3b4 100644
--- a/user/home.js
+++ b/user/home.js
@@ -27,6 +27,12 @@ function fill(fname,lname,email,city)
     document.getElementById("lname").setAttribute("value",lname);
     document.getElementById("email").setAttribute("value",email);
     document.getElementById("city").setAttribute("value",city);
 }
 
+//set token 
+function setToken(token)
+{
+  document.getElementById("csrf-token").setAttribute("value",token);
+}
+
 
diff --git a/user/setting.html b/user/setting.html
index 16ae3e3..c4f0924 100644
--- a/user/setting.html
+++ b/user/setting.html
@@ -45,10 +45,11 @@
 	<form action="setting.php" method="post" enctype="multipart/form-data">
 		<label for="email">Your Email</label><input type="email" name="email" id="email" required> <br>
 		<label for="fname">First Name</label><input type="name" name="fname" id="fname" required><br>
 		<label for="lname">Last Name</label><input type="name" name="lname" id="lname" required><br>
 		<label for="city">City Name</label><input type="text" name="city" id="city" required><br>
+		<input type="text" name="csrf-token" id="csrf-token" hidden>
 		<input type="hidden" name="ch-info"><br>
 		<input type="submit" value="save changes">
 	</form>
 	</div>
 
diff --git a/user/setting.php b/user/setting.php
index c14412f..2c5076f 100644
--- a/user/setting.php
+++ b/user/setting.php
@@ -1,7 +1,8 @@
 <?php
 require("../tasks/condb.php");
+require("../tasks/passw.php");
 session_start();
 if(!isset($_SESSION["id"]))
 {
 	header("location:../login.html");
 }
@@ -13,10 +14,24 @@ if(isset($_POST["ch-info"]))
    $fname=htmlspecialchars($_POST["fname"],ENT_QUOTES,"UTF-8");
    $lname=htmlspecialchars($_POST["lname"],ENT_QUOTES,"UTF-8");
    $email=htmlspecialchars($_POST["email"],ENT_QUOTES,"UTF-8");
    $city=htmlspecialchars($_POST["city"],ENT_QUOTES,"UTF-8");
    $id=$_SESSION["id"];
+   
+    //check token 
+    if(isset($_SESSION["c-token"]) && isset($_POST["csrf-token"]))
+    {
+      $tok=$_POST["csrf-token"];
+      if($_SESSION["c-token"]!=$tok)
+      {
+        exit("action denied!");
+      }
+    } else {
+        exit("action denied!");
+    }
+   
+    
    //no validation from server side 
    $query="update users set fname=?,lname=?,email=?,city=? where id=?";
    $st=$dbcon->prepare($query);
    $st->bind_param("sssss",$fname,$lname,$email,$city,$id);
    $st->execute();
@@ -50,8 +65,10 @@ require("setting.html");
 $fn=$_SESSION["fname"];
 $ln=$_SESSION["lname"];
 $email=$_SESSION["email"];
 $city=$_SESSION["city"];
 echo "<script> fill('$fn','$ln','$email','$city')</script>";
+$tok=$_SESSION["c-token"]=generateSalt();
+echo "<script>setToken('$tok')</script>";
 $dbcon->close();
 
 ?>
\ No newline at end of file

Vulnerable code: 					<input class="inputf" type="email" name="email"> <br>
					<input class="inputf" type="password" name="password">

<html lang="en-us">

    <head>
        <title> admin homepage </title>
        <meta charset="utf-8">
        <meta name="viewport" content="width=device-width,intial-scale=1.0">
        <meta name="keywords"
            content="social media,the best social media platform,chat with your friend ,easy social media,pipago">
        <meta name="description" content="light weight secured student's social media!!!">
        <meta name="author" content="black eagle team">
        <link rel="stylesheet" href="../home.css">
    </head>
    <!-- body goes here -->
    
    <body>
        <!--header-->
        <header>
            <!-- -navigation links-->
            <nav>
    
                <ul>
                    <li><a href="../home.php">pipa analytics</a></li>
                    <li><a href="../mg.php" >manage user </a></li>
                    <li><a href="#" style="background-color: black;"> add admin </a></li>
                    <li><a href="setting.php">setting</a></li>
                    <li><a href="logout.php">logout</a></li>
                </ul>
    
            </nav>
    
        </header>
        <!-- content-->
        <main>
      <div class="addbox">
    <form class="adform" action="add.php" method="POST">
    <label>email</label><br>
    <input type="email" name="email"><br>
    <label>password</label><br>
    <input type="password" name="password">
    <input class="addbutton" type="submit" value="add">
    </form>
    
      </div>
        </main>
        <!--footer content-->
        <footer>
    
    
        </footer>
    </body>
    
    </html>
	header("location:adminlogin.html");
$uemail=htmlspecialchars($_POST["email"], ENT_QUOTES, 'UTF-8');
$upass=htmlspecialchars($_POST["password"], ENT_QUOTES, 'UTF-8');
//if empty password or username!
//alt isempty
if($uemail=="" || $upass=="")
  header("location:add.html");
  exit();
}
require("../../tasks/condb.php");

// Create a prepared statement to prevent SQL injection
$query = "INSERT INTO admin (email, password) VALUES (?, ?)";
$stmt = mysqli_prepare($dbcon, $query);
mysqli_stmt_bind_param($stmt, "ss", $uemail, $upass);
$result = mysqli_stmt_execute($stmt);
if($result)
{
  echo("<p style='color:green;position:absolute;left:250px;top:70px'> successfully added $uemail</p>");
 include("add.html");
  exit();
}  else {
echo("some thing want wrong please try again!");
$dbcon->close();
include("add.html");

	if(isset($_POST['email']))
	if(isset($_POST['password']))
	$newpass=htmlspecialchars($_POST['password'], ENT_QUOTES, 'UTF-8');
	if(isset($_POST['oldpass']))
		$oldpass=htmlspecialchars($_POST['oldpass'], ENT_QUOTES, 'UTF-8');
// SQLi prevention through parameterization
$id = $_SESSION["aid"];
$q = "SELECT * FROM admin WHERE admin_id=?";
$stmt = mysqli_prepare($dbcon, $q);
mysqli_stmt_bind_param($stmt, "i", $id);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
$row = $result->fetch_assoc(); 
$rpass = $row["password"];  //real
				<li><a href="add.html"> add admin </a></li>
    <input type="email" name="email" required><br>
	<input type="password" name="password" required><br>
				<li><a href="atask/add.html"> add admin </a></li>
if(!isset($_POST["email"]));
  $dbcon->close();
    exit;
  $dbcon->close();
    echo "<p style='color:red;text-align:center;font-size:20px;position: absolute;left:700px;top:250px;'> incorrect password or email  </p>";
    exit();
                <li><a href="atask/add.html"> add admin </a></li>
    echo "<p style='color:red;text-align:center;font-size:20px;position: absolute;left:700px;top:250px;'> incorrect password or email  </p>";
Fixed code: 					<input class="inputf" type="email" name="email" required> <br>
					<input class="inputf" type="password" name="password" required>
require("../../tasks/passw.php");
	header("location:../adminlogin.html");
if($_SERVER['REQUEST_METHOD'] == 'POST')
  $uemail=htmlspecialchars($_POST["email"], ENT_QUOTES, 'UTF-8');
  $upass=$_POST["password"];
     //check token 
     if(isset($_SESSION["c-token"]) && isset($_POST["csrf-token"]))
     {
       $tok=$_POST["csrf-token"];
       if($_SESSION["c-token"]!=$tok)
       {
         exit("action denied!");
       }
     } else {
         exit("action denied!");
     }
    
  //if empty password or username!
  //alt isempty
  if($uemail=="" || $upass=="")
  {
    header("location:add.php");
    exit();
  }
  require("../../tasks/condb.php");
  
  // Create a prepared statement to prevent SQL injection
  $query = "INSERT INTO admin (email, password) VALUES (?, ?)";
  $stmt = mysqli_prepare($dbcon, $query);
  mysqli_stmt_bind_param($stmt, "ss", $uemail, $upass);
  $result = mysqli_stmt_execute($stmt);
  
  if($result)
  {
    echo("<p style='color:green;position:absolute;left:250px;top:70px'> successfully added $uemail</p>");
    $dbcon->close();
  }  else {
  echo("some thing want wrong please try again!");
  }
//gen ctoken
$tok=$_SESSION["c-token"]=generateSalt();





<html lang="en-us">

    <head>
        <title> admin homepage </title>
        <meta charset="utf-8">
        <meta name="viewport" content="width=device-width,initial-scale=1.0">
        <meta name="keywords"
            content="social media,the best social media platform,chat with your friend ,easy social media,pipago">
        <meta name="description" content="light weight secured student's social media!!!">
        <meta name="author" content="black eagle team">
        <link rel="stylesheet" href="../home.css">
    </head>
    <!-- body goes here -->
    
    <body>
        <!--header-->
        <header>
            <!-- -navigation links-->
            <nav>
    
                <ul>
                    <li><a href="../home.php">pipa analytics</a></li>
                    <li><a href="../mg.php" >manage user </a></li>
                    <li><a href="#" style="background-color: black;"> add admin </a></li>
                    <li><a href="setting.php">setting</a></li>
                    <li><a href="logout.php">logout</a></li>
                </ul>
    
            </nav>
    
        </header>
        <!-- content-->
        <main>
      <div class="addbox">
    <form class="adform" action="add.php" method="POST">
    <label>email</label><br>
    <input type="email" name="email" required><br>
    <label>password</label><br>
    <input type="password" name="password" required>
    <input type="text" name="csrf-token" value="<?php echo $tok; ?>" hidden>
    <input class="addbutton" type="submit" value="add">
    </form>
    
      </div>
        </main>
        <!--footer content-->
        <footer>
    
    
        </footer>
    </body>
    
    </html>
	if(isset($_POST['email']) && $_POST['email']!="")
	if(isset($_POST['password']) && $_POST['password']!="")
	$newpass=$_POST['password'];
	if(isset($_POST['oldpass']) && $_POST['oldpass']!="")
		$oldpass=$_POST['oldpass'];
$id=$_SESSION["aid"];
$rpass = $_SESSION["password"];  //actual pass
	$_SESSION["password"]=$newpass;
} 

if (($pchanged && $oldpass != $rpass) || ($echanged && $oldpass != $rpass)) {
    echo "incorrect attempt! <br>";
$dbcon->close();
				<li><a href="add.php"> add admin </a></li>
    <input type="email" name="email"  placeholder="unchanged"><br>
	<input type="password" name="password" placeholder="unchanged"><br>
				<li><a href="atask/add.php"> add admin </a></li>
if(!isset($_POST["email"]))
  $_SESSION["password"]=$rows["password"];
    echo "<p style='color:red;text-align:center;font-size:20px;'> incorrect password or email  </p>";
$dbcon->close();
                <li><a href="atask/add.php"> add admin </a></li>
    echo "<p style='color:red;text-align:center;font-size:20px;'> incorrect password or email  </p>";
<?php

//generate salt 
function generateSalt()
{
  $randb=random_bytes(16);
  return bin2hex($randb);
}

//hash password 
function hashPass($plain,$salt)
{
    $password=$plain.$salt;
    return hash("sha256",$password);
}

?>
//set token 
function setToken(token)
{
  document.getElementById("csrf-token").setAttribute("value",token);
}

		<input type="text" name="csrf-token" id="csrf-token" hidden>
require("../tasks/passw.php");
   
    //check token 
    if(isset($_SESSION["c-token"]) && isset($_POST["csrf-token"]))
    {
      $tok=$_POST["csrf-token"];
      if($_SESSION["c-token"]!=$tok)
      {
        exit("action denied!");
      }
    } else {
        exit("action denied!");
    }
   
    
$tok=$_SESSION["c-token"]=generateSalt();
echo "<script>setToken('$tok')</script>";