CSRF1: This should have a CSRF token CSRF2: Only checks if the length of the CSRF token is correct CSRF3: The CSRF token is the userID CSRF4: Only checks that the token is not empty CSRF5: The system only checks if what you submitted is part of the CSRF token. This means that if you only submit "1" you have a good chance of randomly guessing a possible token.