I'm using this function in control panel, to append md5(session_id()) to each form and link in this panel. I also check when receiving data in control panel, if it contains this md5. I think it's quite good way to prevent the attack, where the user posts an image to the forum, but instead of image url, it specifies the url to control panel with some instructions. You should also check if the data come from the source you intended (GET or POST?).