Question is not specific to PHP only, it is generic for Web development, language will not matter.
PHP has session tokens through which server will identify the session id of a specific user, (this is similar to many other languages). These tokens can be sent via cookies or via embedding in urls. In terms CSRF attacks, urls one are much better but these also expose many other security issues as token is embedded automatically (if you did not change your ini settings) to urls.…