has a great article on preventing Cross-Site Request Forgeries (CSRF).

Essentially, the principal is that a long random hash that is known by the server is written into a form that is to be posted. An example of this is the following HTML for a login box and form: