session_start();
$app_id = "146199188........";
$app_secret = "171a7caaffeeab3c8f..........";
$my_url = "http://localhost/facebook.php";
$code = $_REQUEST["code"];

if(empty($code)) {
    $_SESSION['state'] = md5(uniqid(rand(), TRUE)); // CSRF protection
    $dialog_url = "https://www.facebook.com/dialog/oauth?" 
                              . "client_id=". $app_id 
                              . "&redirect_uri=" . urlencode($my_url) 
                              . "&state=". $_SESSION['state'] 
                              . "&scope=user_birthday,read_stream&display=popup";
    echo("<script type=\"text/javascript\">top.window.location.href='" . $dialog_url . "'</script>");
}
if($_SESSION['state'] && ($_SESSION['state'] === $_REQUEST['state'])) {
      .....bla....bla...bla......
}else {echo("The state does not match. You may be a victim of CSRF.");}

 echo("<script type=\"text/javascript\">top.window.location.href='" . $dialog_url . "'</script>");