insecure-comment-form.php

<?php

/**
 * templates/comment-form.php
 *
 * NOTE: THIS IS PART OF AN EXAMPLE OF VERY INSECURE CODE!  DO NOT USE THIS!
 */
?>
<?php if ($user->isLoggedIn())
{
?>
<form action="/submit.php">
<?php displayValidationMessages($_SESSION['formstate']['comment-form']['messages']); ?>
<input type="hidden" name="formid" value="comment-form" />
<input type="hidden" name="csrf-token" value="<?php generateCsrfToken($user); ?>" />
<input type="hidden" name="current-article" value="<?php echo getCurrentArticle(); ?>" />
<textarea rows="4" columns="30" name="comment">
<?php 
if(!empty($_SESSION['formstate']['comment-form']['comment'])) 
{ 
    echo $_SESSION['formstate']['comment-form']['comment']; 
} 
?>
</textarea>
<?php
} // end if ($user->isLoggedIn())