我有一个简单的表单,并希望验证发布的值来自该表单的目录,而不是来自外部源.
<form action="<?PHP echo $_SERVER['REQUEST_URI']; ?>" method="POST">
<input type="text" name="post" id="post" />
<input type="submit" name="submit" id="submit" />
</form>
我需要在会话中存储一些东西吗?一个简单的例子非常有帮助.谢谢.
解决方法:
创建表单时,您可以使用:
<?PHP
session_start(); // don't forget that you need to call before output (place first, or use ob_start()
$_SESSION['formhash'] = md5(date('Y-m-d H:i:s').'2fiaSFI#T8ahugi83okkj');
?>
<form action="<?PHP echo $_SERVER['REQUEST_URI']; ?>" method="POST">
<input type="text" name="post" id="post" />
<input type="hidden" name="hash" id="hash" value="<?PHP echo $_SESSION['formhash']; ?>" />
<input type="submit" name="submit" id="submit" />
</form>
您需要检查何时发布帖子请求具有正确哈希的人.你可以使用:
<?PHP
session_start(); // don't forget that you need to call before output (place first, or use ob_start()
if (isset($_SESSION['formhash']) && isset($_POST['hash']) && $_SESSION['formhash']==$_POST['hash']) {
// treat $_POST
}
?>