My plugin has a tab in the CP. On that tab is a form. What's the way for PHP to generate a CSRF token that can be output to the form with echo?
EDIT to document the final answer
$token = craft()->request->getCsrfToken();
$out .= <<<MYFORM
<form action="#" method="post">
<input type='hidden' name="CRAFT_CSRF_TOKEN" value='$token'>
...
</form>
MYFORM;
return $out;
And make sure that /craft/config/general.php includes this:
return array(
'enableCsrfProtection' => true,
);
echo
. If you want to pass data back to your Twig template, there are several other (much better) ways to do it. Most of the time you'll want to use a Variable defined by your plugin.