Club Drupal

  // If the session token was set by drupal_prepare_form(), ensure that it

  // matches the current user's session. This is duplicate to code in

  // form_builder() but left to protect any custom form handling code.

    if (!drupal_valid_token($form_state['values']['form_token'], $form['#token']) || !empty($form_state['invalid_token'])) {

      _drupal_invalid_token_set_form_error();

      // Stop here and don't run any further validation handlers, because they

      // If the session token was set by drupal_prepare_form(), ensure that it

      // matches the current user's session.

      $form_state['invalid_token'] = FALSE;

        if (empty($form_state['input']['form_token']) || !drupal_valid_token($form_state['input']['form_token'], $element['#token'])) {

          // Set an early form error to block certain input processing since that

          // opens the door for CSRF vulnerabilities.