CSRF attacks can be simple

<?
$url = '/talks/apachecon2003/12';
$tag = "<img src=\"$url?message=Hi\">";
echo htmlentities($tag);
echo $tag;
?>