diff --git a/controller/main.php b/controller/main.php
index de166fb..ba78e25 100644
--- a/controller/main.php
+++ b/controller/main.php
@@ -94,8 +94,16 @@ public function handle()
 			throw new http_exception(403, 'NOT_AUTHORISED');
 		}
 
+		$form_key = 'phpbb_skeleton';
+		add_form_key($form_key);
+
 		if ($this->request->is_set_post('submit'))
 		{
+			if (!check_form_key($form_key))
+			{
+				throw new http_exception(403, 'FORM_INVALID');
+			}
+
 			try
 			{
 				$this->get_composer_data();
diff --git a/skeleton/service.php.twig b/skeleton/service.php.twig
index b7567ec..63b5d34 100644
--- a/skeleton/service.php.twig
+++ b/skeleton/service.php.twig
@@ -40,7 +40,6 @@ class service
 	 */
 	public function get_user()
 	{
-		var_dump($this->table_name);
 		return $this->user;
 	}
 }
diff --git a/styles/prosilver/template/skeleton_body.html b/styles/prosilver/template/skeleton_body.html
index 878c270..8c66fb5 100644
--- a/styles/prosilver/template/skeleton_body.html
+++ b/styles/prosilver/template/skeleton_body.html
@@ -11,7 +11,7 @@
 {% INCLUDECSS '@phpbb_skeleton/skeleton.css' %}
 
 <script>
-	var warningMsg = '{{ lang('SKELETON_RESERVED_NAME_WARNING_UI') }}';
+	var warningMsg = '{{ lang('SKELETON_RESERVED_NAME_WARNING_UI')|e('js') }}';
 </script>
 
 <h2>{{ lang('PHPBB_CREATE_SKELETON_EXT') }}</h2>
@@ -132,7 +132,7 @@ <h3 class="skeleton-components">{{ lang('SKELETON_COMPONENT_GROUP_' ~ group) }}<
 <div class="panel">
 	<div class="inner">
 		<fieldset class="submit-buttons">
-			{{ S_HIDDEN_FIELDS }}
+			{{ S_FORM_TOKEN }}
 			<input type="submit" accesskey="s" name="submit" value="{{ lang('SUBMIT') }}" class="button1">
 		</fieldset>
 	</div>
diff --git a/tests/controller/main_test.php b/tests/controller/main_test.php
index 620e462..760c58a 100644
--- a/tests/controller/main_test.php
+++ b/tests/controller/main_test.php
@@ -18,6 +18,8 @@
 use phpbb\skeleton\ext;
 use Symfony\Component\DependencyInjection\ContainerInterface;
 
+require_once __DIR__ . '/test_helpers.php';
+
 class main_test extends \phpbb_test_case
 {
 	/** @var \phpbb\template\template|\PHPUnit\Framework\MockObject\MockObject */
@@ -50,6 +52,9 @@ class main_test extends \phpbb_test_case
 	protected function setUp(): void
 	{
 		global $phpbb_root_path;
+		global $phpbb_skeleton_form_key_valid;
+
+		$phpbb_skeleton_form_key_valid = true;
 
 		// Mocks are dummy implementations that provide the API of components we depend on //
 		$this->template = $this->getMockBuilder('\phpbb\template\template')
@@ -272,6 +277,30 @@ public function test_handle_unauthorised()
 		$this->get_controller($this->packager_mock)->handle();
 	}
 
+	public function test_submit_invalid_form_key()
+	{
+		global $phpbb_skeleton_form_key_valid;
+
+		$this->user->data['is_bot'] = false;
+		$phpbb_skeleton_form_key_valid = false;
+
+		$this->request->expects($this->once())
+			->method('is_set_post')
+			->with('submit')
+			->willReturn(true);
+
+		$this->packager_mock->expects($this->never())
+			->method('create_extension');
+
+		$this->packager_mock->expects($this->never())
+			->method('create_zip');
+
+		$this->expectException(http_exception::class);
+		$this->expectExceptionMessage('FORM_INVALID');
+
+		$this->get_controller($this->packager_mock)->handle();
+	}
+
 	public function test_submit_success()
 	{
 		$this->user->data['is_bot'] = false;
diff --git a/tests/controller/test_helpers.php b/tests/controller/test_helpers.php
new file mode 100644
index 0000000..fa5fb48
--- /dev/null
+++ b/tests/controller/test_helpers.php
@@ -0,0 +1,25 @@
+<?php
+/**
+ *
+ * This file is part of the phpBB Forum Software package.
+ *
+ * @copyright (c) phpBB Limited <https://www.phpbb.com>
+ * @license GNU General Public License, version 2 (GPL-2.0)
+ *
+ * For full copyright and license information, please see
+ * the docs/CREDITS.txt file.
+ *
+ */
+
+namespace phpbb\skeleton\controller;
+
+function add_form_key($form_name)
+{
+}
+
+function check_form_key($form_name)
+{
+	global $phpbb_skeleton_form_key_valid;
+
+	return $phpbb_skeleton_form_key_valid;
+}