<?php
session_start();
function generateToken($seed='mysupersecretkey')
	{
		$token = md5($seed.mktime());
		$_SESSION['token']=$token;
		return $token;
	}
generateToken();

//validate the form
if(isset($_POST['email']) && isset($_POST['pass']) && isset($_POST['token']))
{
	if($_POST['token'] != $_SESSION['token'])
	{
		die('Token is invalid');
	}
	//process the rest of form here
	
}
?>

<form action="test.php" method="post" name="test">
<input name="email" type="text" />
<input name="pass" type="password" />
<input name="token" type="hidden" value="<?php echo $_SESSION['token']; ?>" />
</form>