Task 9: Add CSRF tokens to form templates and backend processors

Updated forms with hidden CSRF token fields:
- comment_box.php - Comment form
- course_details.php - Course booking form
- campsites.php - Campsite addition modal form
- bar_tabs.php - Bar tab creation modal form
- membership_application.php - Membership application form

Updated backend processors with CSRF validation:
- create_bar_tab.php - Bar tab AJAX processor
- add_campsite.php - Campsite form processor
- submit_order.php - Order submission processor

All forms now require validated CSRF tokens before processing, preventing cross-site request forgery attacks.

submit_order.php

@@ -1,6 +1,14 @@
 <?php
 session_start();
 require_once("connection.php");
+require_once("functions.php");
+
+// CSRF Token Validation
+if (!isset($_POST['csrf_token']) || !validateCSRFToken($_POST['csrf_token'])) {
+    http_response_code(403);
+    echo json_encode(['status' => 'error', 'message' => 'Security token validation failed.']);
+    exit();
+}
 
 if (isset($_POST['tab_id']) && isset($_SESSION['cart'][$_POST['tab_id']])) {
     $tab_id = (int) $_POST['tab_id']; // Ensure it's an integer