diff --git a/user/edit.html b/user/edit.html
index d2b29a970e2..daac98843f8 100644
--- a/user/edit.html
+++ b/user/edit.html
@@ -396,4 +396,5 @@ if (isadmin()) {
 </table>
 <input type="hidden" name="course" value="<?php p($course->id) ?>" />
 <input type="hidden" name="id" value="<?php p($user->id) ?>" />
+<input type="hidden" name="sesskey" value="<?php p(sesskey()) ?>" />
 </form>
diff --git a/user/edit.php b/user/edit.php
index d6bfde3ada2..ac1c739cfd7 100644
--- a/user/edit.php
+++ b/user/edit.php
@@ -69,7 +69,7 @@
     
 /// If data submitted, then process and store.
 
-    if ($usernew = data_submitted()) {
+    if ($usernew = data_submitted() and confirm_sesskey()) {
 
         if (($USER->id <> $usernew->id) && !isadmin()) {
             print_error('onlyeditown');