Data from the exact form

问题:

I have been googling a lot but i am still without an answer so i decided to ask this question here: Is there a way in PHP how to check that the data i am receiving in some script are from the specific form on the page? I am asking because everyone can see the name of the script i am using for saving the data to my database, so if somebody is able to find out the whole URL, he is also able to send some fake data to the script and i need a condition, that the saving process is triggered only when the data comes from the proper form on my page.

I am using jQuery to call AJAX function, so basically if i click on the button "send", the $.POST() method is triggered to call the script for saving the data.

Thanks, Tomas

回答1:

Use tokens to check if request is valid

You could always add some kind of security token when submitting data:

Tokens can be easily extended for many different uses and covers wide area when it comes to checking if some request is valid, for example you could let your non critical forms open for public, ask users to get their secret keys from some page (forcing them to open that page) and then use those keys to identify them when submitting data.

Of course all of this can be completely transparent to user as you could give keys from front page via cookies (or session cookies, it does not matter here, no more or less security as server keys should change after use and invalidate within specified time or when user's identity changes).
In this example of use, only user that opened front page can submit data to server.

Another case is when cookies is given away at same page which contains form for submitting data to server. Every user that open page will have their keys to submit data straight away, however if someone tries to make request from outside it will fail.
See OWASP Cross Site Request Forgery
and codinghorror.com Blog CSRF and You

Only with AJAX?

Here is my answer to another question, this answer covers different methods for inserting additional data to ajax request: Liftweb: create a form that can be submitted both traditionally and with AJAX (take a closer look at

$.ajax({ 
    ... 
    data: /* here */ 
    ...

Currently I am using tokens this way:

Form used to submit

This hidden input can be added to form, it is not requirement as you can use methods described earlier at another answer.

<input type="hidden" name="formid" value="<?php echo generateFormId(); ?>" />

Function generateFormId()

Simply generate random string and save it to session storage

function generateFormId() {
    // Insert some random string: base64_encode is not really needed here
    $_SESSION['FORM_ID'] = 'FormID'.base64_encode( uniqid() );
    // If you want longer random string mixed with some other method just add them:
    //$_SESSION['FORM_ID'] = 'FormID'.base64_encode( crypt(uniqid()).uniqid('',true) );
    return $_SESSION['FORM_ID'];
}

Processing submitted form data

if (!isset($_SESSION['FORM_ID']) || $_SESSION['FORM_ID'] != $_POST['formid']) {
    // You can use these if you want to redirect user back to form, preserving values:
    //$_SESSION['RELOAD_POST'] = $_POST;
    //$_SESSION['RELOAD_ID'] = uniqid('re');
    echo 'Form expired, cannot submit values.';
    //echo '<a href="form.php?reload='.$_SESSION['RELOAD_ID'].'">Go back and try again</a>';
    exit(1); // <== Stop processing in case of error.
}

If you need to check which form is submitting data

Then you could just add prefix when generating id's and check for that prefix when processing form data.

This is case when one php script deals with many different forms.

---

Remember that only ultimate answer to prevent evil users is to pull off all wires from your server...

回答2:

This is an interesting topic, but you are missing an important point: A spam robot / bad user could also bomb your database by using that specific form page (!).

So, the question is not how to check if the request comes from that page or not, the question is how to check if he's a regular user or a robot/spammer/bot.

Do it with a captcha, like http://www.recaptcha.net

In case i slightly misunderstood the question: If you want to be sure that the request comes from a "real" user you will have to work with a login system / user system and check for users id / password (via db or sessions) every time you want to do a db request.

回答3:

You can verify that the page is being requested via AJAX with checking against this:

strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) != 'xmlhttprequest'

You could also check the HTTP_REFERER.

But it sounds like you're trying to protect a page that processes vulnerable data. This requires more than just the two things above. I'd recommend googling 'CSRF Forgery' to get more information on this.

回答4:

These are something that you should take a look at.

1. Capthcas.
2. Referer check.
3. Use POST than GET. [Still Curl can automate it.]