diff --git a/admin/index.php b/admin/index.php
index b133284e293..2bf4e960bfb 100644
--- a/admin/index.php
+++ b/admin/index.php
@@ -314,7 +314,7 @@
                  get_string("adminhelpauthentication")."</font><br />";
     $userdata .= "<font size=+1>&nbsp;</font><a href=\"user.php\">".get_string("edituser")."</a> - <font size=\"1\">".
                  get_string("adminhelpedituser")."</font><br />";
-    $userdata .= "<font size=+1>&nbsp;</font><a href=\"$CFG->wwwroot/$CFG->admin/user.php?newuser=true\">".
+    $userdata .= "<font size=+1>&nbsp;</font><a href=\"$CFG->wwwroot/$CFG->admin/user.php?newuser=true&sesskey=$USER->sesskey\">".
                  get_string("addnewuser")."</a> - <font size=\"1\">".
                  get_string("adminhelpaddnewuser")."</font><br />";
     $userdata .= "<font size=+1>&nbsp;</font><a href=\"$CFG->wwwroot/$CFG->admin/uploaduser.php?sesskey=$USER->sesskey\">".
diff --git a/admin/user.php b/admin/user.php
index 77507b5451d..75163448355 100644
--- a/admin/user.php
+++ b/admin/user.php
@@ -1,4 +1,4 @@
-<?PHP // $Id$
+<?php // $Id$
 
     require_once("../config.php");
 
@@ -78,7 +78,7 @@
         error("You must be an administrator to edit users this way.");
     }
 
-    if ($newuser) {                 // Create a new user
+    if ($newuser and confirm_sesskey()) {                 // Create a new user
         $user->auth      = "manual";
         $user->firstname = "";
         $user->lastname  = "";
@@ -135,7 +135,7 @@
                 notify(get_string("usernotconfirmed", "", fullname($user, true)));
             }
 
-        } else if ($delete) {              // Delete a selected user, after confirmation
+        } else if ($delete and confirm_sesskey()) {              // Delete a selected user, after confirmation
             if (!$user = get_record("user", "id", "$delete")) {
                 error("No such user!");
             }
@@ -148,7 +148,7 @@
             if ($confirm != md5($delete)) {
                 $fullname = fullname($user, true);
                 notice_yesno(get_string("deletecheckfull", "", "'$fullname'"),
-                     "user.php?delete=$delete&amp;confirm=".md5($delete), "user.php");
+                     "user.php?delete=$delete&amp;confirm=".md5($delete)."&amp;sesskey=$USER->sesskey", "user.php");
 
                 exit;
             } else if (!$user->deleted) {
@@ -301,7 +301,7 @@
                 if ($user->id == $USER->id or $user->username == "changeme") {
                     $deletebutton = "";
                 } else {
-                    $deletebutton = "<a href=\"user.php?delete=$user->id\">$strdelete</a>";
+                    $deletebutton = "<a href=\"user.php?delete=$user->id&sesskey=$USER->sesskey\">$strdelete</a>";
                 }
                 if ($user->lastaccess) {
                     $strlastaccess = format_time(time() - $user->lastaccess);
@@ -333,8 +333,7 @@
             }
             echo "</form>";
             echo "</td></tr></table>";
-            print_heading("<a href=\"user.php?newuser=true\">".get_string("addnewuser")."</a>");
-
+            print_heading("<a href=\"user.php?newuser=true&sesskey=$USER->sesskey\">".get_string("addnewuser")."</a>");
 
             print_table($table);
 
@@ -344,8 +343,7 @@
 
         }
 
-        print_heading("<a href=\"user.php?newuser=true\">".get_string("addnewuser")."</a>");
-
+        print_heading("<a href=\"user.php?newuser=true&sesskey=$USER->sesskey\">".get_string("addnewuser")."</a>");
 
         print_footer();
     }
diff --git a/admin/users.php b/admin/users.php
index 771184fa2c1..c287a493832 100644
--- a/admin/users.php
+++ b/admin/users.php
@@ -28,7 +28,7 @@
     $table->data[] = array("<b><a href=\"user.php\">".get_string("edituser")."</a></b>",
                            get_string("adminhelpedituser"));
     if (is_internal_auth()) {
-        $table->data[] = array("<b><a href=\"$CFG->wwwroot/$CFG->admin/user.php?newuser=true\">".get_string("addnewuser")."</a></b>",
+        $table->data[] = array("<b><a href=\"$CFG->wwwroot/$CFG->admin/user.php?newuser=true&sesskey=$USER->sesskey\">".get_string("addnewuser")."</a></b>",
                                get_string("adminhelpaddnewuser"));
         $table->data[] = array("<b><a href=\"$CFG->wwwroot/$CFG->admin/uploaduser.php?sesskey=$USER->sesskey\">".get_string("uploadusers")."</a></b>",
                                get_string("adminhelpuploadusers"));