How to clean a variable against xss and sql injections attack?
This should be quite efective:

$var=mysql_real_escape_string(trim(htmlspecialchars(strip_tags($_GET['var']))));

How does csrf attacks work?

An example:

Suppose that you have a page that deletes users, like user_delete.php?id= . On that page you take the id, verify in the session that the user has acces to delete that user, and you delete the user.