I have the following code which is supposed to insert a row into a DB table clicks (consisting of 1 Primary AI column id and another column user which contains the user's session ID) upon clicking the Like button. For each user assuming they have a session ID set from a login I would like to return to them their most recently inserted ID from the table. So the first time the button is clicked it will return 1 etc. I would like this to be accessible to multiple users through a login system.Is this vulnerable to Cross-site request forgery and if so, how can I alter the code to defend against it?index.php:<?phpinclude 'init.php';include 'connect.php';?><!doctype html><html><body>    <?php           $userid = $_SESSION['user_id'];   echo '<a class=like href=# onclick=like_add(', $userid,     ');>Like</a>';    ?>    <script type =text/javascript src=jquery-1.11.1.min.js></script>    <script type =text/javascript src=like.js></script>      </body></html>connect.php<?php  $servername = localhost;$username = root;$password = ;$dbname = DB;$conn = new mysqli($servername, $username, $password, $dbname);if ($conn->connect_error) {die(Connection failed:  . $conn->connect_error);}?>init.php<?phpsession_start();$_SESSION['user_id']='1';$userid = $_SESSION['user_id'];include 'connect.php';include 'like.php';?>like.jsfunction like_add(userid) {$.post('like_add.php', {userid:userid}, function(data) {   if (data == 'success'){    add_like($userid);   } else{       alert(data);   }});}like.php<?phpfunction add_like($userid){include 'connect.php';$stmt = $conn->prepare(INSERT INTO clicks (user) VALUES (?));$stmt->bind_param(s, $userid);$stmt->execute();$stmt = $conn->prepare(SELECT max(id) FROM clicks WHERE user=?);$stmt->bind_param(s, $userid);$stmt->execute();$stmt->bind_result($click);$stmt->fetch();echo $click;$stmt->close();}?>like_add.php<?phpinclude 'init.php';if (isset($userid)) {$userid = $userid;add_like($userid);}?>
Cross-site request forgery defense for code to count Likes
javascript;php;security;session