$_GET should be tokenized

Any user action performed using $_GET should be accompanied by a token.

For example, logging out a user can be done by anyone like this thread does because of the broken image below.

The image navigates to http://www.girlswithmuscle.com/?logout=1, however if you had a random token along with it that would block someone from performing actions as another user. For example http://www.girlswithmuscle.com/?logout=93ckd24 would prevent me from guessing the token.

Logging out a user is harmless, but other actions could pose a risk to the user.

Thanks. You are right, that is how it should be done.

I'm going to edit the image out of your post so that it does not affect more users.

The logout is fixed now. Please let me know if you find other similar things lying around.