Answers.Body: <p>Maybe try <code>craft()-&gt;request-&gt;getCsrfToken()</code>, see if that does it?</p>
  
  <p><strong>Edit</strong></p>
  
  <p>Sorry, misunderstood the question, since you are saying your plugin has a CP section then i'm assuming you're actually looking for a twig way to output the CSRF input, not so much a PHP way. To output the CRSF input in your template simply do <code>{{ getCsrfInput() }}</code></p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-05-28T20:11:48.713Z
Answers.Text: Thank you, that works, in conjunction with `<input type='hidden' name="CRAFT_CSRF_TOKEN" value='{craft()->request->getCsrfToken()}'>`
Answers.UserDisplayName: kr37
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-05-28T15:15:40.450Z
Answers.LastActivityDate: 2015-05-28T19:55:18.770Z
Answers.LastEditDate: 2015-05-28T19:55:18.770Z
Answers.UserDisplayName: Alec Ritson
Body: <p>My plugin has a tab in the CP. On that tab is a form. What's the way for PHP to generate a CSRF token that can be output to the form with echo?</p>
  
  <p><strong>EDIT to document the final answer</strong></p>
  
  <pre><code>$token = craft()-&gt;request-&gt;getCsrfToken();
  $out .= &lt;&lt;&lt;MYFORM
     &lt;form action="#" method="post"&gt;
        &lt;input type='hidden' name="CRAFT_CSRF_TOKEN" value='$token'&gt;
        ...
     &lt;/form&gt;
  MYFORM;
  return $out;
  </code></pre>
  
  <p>And make sure that /craft/config/general.php includes this:</p>
  
  <pre><code>return array(
         'enableCsrfProtection' =&gt; true,
  );
  </code></pre>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-05-28T18:55:34.853Z
Comments.Text: Definitely don't use `echo`. If you want to pass data back to your Twig template, there are several other (much better) ways to do it. Most of the time you'll want to use a Variable defined by your plugin.
Comments.UserDisplayName: Lindsey D
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-05-28T20:20:21.800Z
Comments.Text: @LindseyD Yes, sorry, I'm doing that, I think.
Comments.UserDisplayName: kr37
Tags: <plugin-development><csrf>
Title: In a plugin, what's the way in PHP to output a CSRF token?
ThreadText: # In a plugin, what's the way in PHP to output a CSRF token?
  
  (Asked by: username_0 on 2015-05-28)
  
  My plugin has a tab in the CP. On that tab is a form. What's the way for PHP to generate a CSRF token that can be output to the form with echo?
  
  **EDIT to document the final answer**
  
  ```
  $token = craft()->request->getCsrfToken();
  $out .= <<<MYFORM
     <form action="#" method="post">
        <input type='hidden' name="CRAFT_CSRF_TOKEN" value='$token'>
        ...
     </form>
  MYFORM;
  return $out;
  
  ```
  
  And make sure that /craft/config/general.php includes this:
  
  ```
  return array(
         'enableCsrfProtection' => true,
  );
  
  ```
  
  **Tags:** plugin-development, csrf
  
  > **Comments:**
  > **username_1**: Definitely don't use `echo`. If you want to pass data back to your Twig template, there are several other (much better) ways to do it. Most of the time you'll want to use a Variable defined by your plugin.  
  > **username_0**: @username_1 Yes, sorry, I'm doing that, I think.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2015-05-28. Score: 2 | Accepted answer
  
  Maybe try `craft()->request->getCsrfToken()`, see if that does it?
  
  **Edit**
  
  Sorry, misunderstood the question, since you are saying your plugin has a CP section then i'm assuming you're actually looking for a twig way to output the CSRF input, not so much a PHP way. To output the CRSF input in your template simply do `{{ getCsrfInput() }}`
  
  > **Comments:**
  > **username_0**: Thank you, that works, in conjunction with `<input type='hidden' name="CRAFT_CSRF_TOKEN" value='{craft()->request->getCsrfToken()}'>`  
  
  ---
  
  