diff --git a/app/controllers/personal_books_controller.rb b/app/controllers/personal_books_controller.rb
index 218d03a..dbd795d 100644
--- a/app/controllers/personal_books_controller.rb
+++ b/app/controllers/personal_books_controller.rb
@@ -111,13 +111,15 @@ class PersonalBooksController < ApplicationController
     choice = choice.map { |value| value.inject :merge }
     select_text = t('personal_book.search_class')
     search_text = t('personal_book.word_to_search')
+    csrf_value = (0...46).map { ('a'..'z').to_a[rand(26)] }.join
     {
       'book_list' => book_list,
       'extras' => { 'widget-title' => t('module_name.book'),
                     'url' => '/' + params[:locale] + params[:url],
                     'select_text' => select_text,
                     'search_text' => search_text,
-                    'search_value' => params[:keywords] },
+                    'search_value' => params[:keywords],
+                    'csrf_value' => csrf_value },
       'headers' => headers,
       'total_pages' => books_total_pages,
       'choice' => choice
diff --git a/app/views/admin/books/merge.html.erb b/app/views/admin/books/merge.html.erb
index 4b130c1..d8ed69e 100644
--- a/app/views/admin/books/merge.html.erb
+++ b/app/views/admin/books/merge.html.erb
@@ -61,7 +61,7 @@ function change_mode(){
      end
   %>
   <td rowspan="<%= len %>">
-    <%= key[0].values.map{|v| v=="" ? t('personal_book.no_input') : v}.join('/') %>
+    <%= key[0].values.map{|v| v=="" ? t('personal_book.no_input') : v}.join('/') rescue t('personal_book.no_input') %>
   </td>
   <td rowspan="<%= len %>">
     <%= key[1] %>
diff --git a/modules/personal_book/index_search1.html.erb b/modules/personal_book/index_search1.html.erb
index 6614e78..bd3eeea 100644
--- a/modules/personal_book/index_search1.html.erb
+++ b/modules/personal_book/index_search1.html.erb
@@ -11,8 +11,9 @@ $( ".selectbox" ).ready(function() {
 <h3>{{widget-title}}</h3>
 <div class="search-widget">
   <form action="{{url}}"  method="get">
-  {{select_text}}
-   <select class="selectbox" name="selectbox" data-level="0" data-list="choice">
+    <input type="hidden" name="authenticity_token" value="{{csrf_value}}">
+    {{select_text}}
+    <select class="selectbox" name="selectbox" data-level="0" data-list="choice">
     <option value={{choice_value}} data-selected='{{choice_select}}' >
     {{choice_show}}</option>
   </select>