What is the best way to create a number-used-once security token in PHP?

Question

For security purposes, I would like to create a security token for every CRUD operation on a site running a LAMP stack. The security token would be attached to the a href URL and would be verified after the user clicks on the link before displaying or doing anything.

First of all, are using security tokens a good first step in securing the application, or are there better alternatives?

Second, what is the best way to do this with PHP? Any recommendations and especially code would be helpful. I am new to using security tokens, so any explanations would be great.

(By best, I mean most secure and usable at the same time)

Answer 1

You might use uniqid:

$token = md5(uniqid(mt_rand(), true));

Answer 2

Won't stop a XSS attack, since the hacker can grok your HTML and extract the href's with security tokens in them.