PHP through session anti-URL attack method _php skills

This article describes the PHP through session to prevent the URL attack method. Share to everyone for your reference. The implementation methods are as follows:

Through the session tracking, you can easily avoid the occurrence of URL attacks, PHP session to prevent the URL attack method code as follows:

Copy Code code as follows:

<?php
Session_Start ();
$clean = Array ();
$email _pattern = '/^[^@s<&>]+@ ([-a-z0-9]+.) +[a-z]{2,}$/i ';
if (Preg_match ($email _pattern, $_post[' email '))
{
$clean [' email '] = $_post[' email '];
$user = $_session[' user '];
$new _password = MD5 (Uniqid (rand (), TRUE);
if ($_session[' verified '])
{
/* Update Password * *
Mail ($clean [' email '], ' Your New Password ', $new _password);
}
}
?>

When used, the URL can be set as follows:
http://example.org/reset.php?user=php&email=chris%40example.org

If reset.php trusts the information provided by the user, this is a semantic URL attack vulnerability, in which case the system will generate a new password for the PHP account and send it to chris@example.org so that Chris can successfully steal the PHP account.

I hope this article will help you with your PHP program design.