diff --git a/tag/manage.php b/tag/manage.php
index 3fe1fd4a37654..4c1e3ea097e65 100644
--- a/tag/manage.php
+++ b/tag/manage.php
@@ -112,6 +112,10 @@
         }
         break;
     case 'addofficialtag':
+        if (!data_submitted() or !confirm_sesskey()) {
+            break;
+        }
+
         $new_otags = explode(',', optional_param('otagsadd', '', PARAM_TAG));
         $notice = '';
         foreach ( $new_otags as $new_otag ) {
@@ -140,6 +144,7 @@
 print('<input type="hidden" name="action" value="addofficialtag">');
 print('<div class="tag-management-form generalbox"><label class="accesshide" for="id_otagsadd">'. get_string('addotags', 'tag') .'</label>'.
     '<input name="otagsadd" id="id_otagsadd" type="text">'.
+    '<input type="hidden" name="sesskey" value="'.sesskey().'">'.
     '<input name="addotags" value="'. get_string('addotags', 'tag') .'" onclick="skipClientValidation = true;" id="id_addotags" type="submit">'.
     '</div>');
 print('</form>');