Ask a master: Php post submission problem

PHP Post Submission

Shrimp made a program: through the AJAX technology call background PHP execution process to MySQL write database, the function is realized.
Later found that users through the URL directly pieced together parameters manually through the URL input method to invoke PHP execution process.
Question 1: Is there any good way to prohibit direct manual submission to the background through the URL?
I looked up some help to the effect that before the submission: by Time t to the background to obtain the corresponding encryption key value K1,
When formally committed, both T and K1 are committed, the background is re-encrypted by T K2, if K1 is the same as K2, the write to the database procedure.
Issue 2: This method increases the acquisition of the key value K1 this process, certainly more time than not getting K1. Is there any way to circumvent it?
Issue 3: Get the Encryption key value K1 this process and how to ensure that no one else directly by hand through the URL to the background call it?
I beg your advice!
Thank you first!

Reply to discussion (solution)

I usually do that.

The specific code

Then there is no, is the final "?>" removed, so that the direct submission of the page will be due to grammatical errors and can not be executed

I usually do that.

The specific code

Then there is no, is the final "?>" removed, so that the direct submission of the page will be due to grammatical errors and can not be executed
-------
This solution is a little "folk prescription" flavor ... ，
Sincere thanks to reply!

To tell the truth B/s architecture is difficult to avoid the server side of the data received must be sent by the browser side you want, after all, the server side just provide a page for the client request, after receiving the request to start running. Even if you use the session to verify login can also be simulated, so it is difficult to receive the data must be returned by you to the page produced, at least I did not think there is any way, hehe.
It is recommended to add some hidden on the form, by verifying the value of the hidden (similar to the method proposed by the landlord), but these methods can be simulated, only to prevent the low-tech people.

I don't know how to guard against this call method. After all, the interface is written to make use of, as long as the rules to make it call it, the interface as far as possible to write security.

About write less? >xuzuning version of the big talk about, this is more standard more appropriate wording, PHP will automatically put the last line behind the newline and the blank all deleted. As to whether the landlord's problem is effective, it is unclear.

Using sesseion can prevent malicious injection of data by: http://www.ibihuo.com/show-60.html

Don't you need to login in the background?

To Anglegz: You reply from the height of my doubts, but my application is b/s, changed to b/c is not possible;
To Anyilaoliu: interface Write security is a solution, the user manual URL way to submit the essence is to skip the Ajax check step directly to the backstage;
To AHUI_LCM: is required to log in, is currently logged in the user (not login is not able to submit), on the same machine to open an identical browser, manually submitted illegal data in the address bar.
To y244360439: Your link "then store this value with Sesseion, $_sesseion[' hash ') = $hash;
"How do you ensure that the stored procedure that writes the session is not called by the user alone?" I understand that writing the session process is also a post with parameters, which can also be manually submitted in the address bar, is not I understand it wrong?
Thank you, do you have any other suggestions?

In the foreground with JS to make the restrictions and judgments in PHP to judge again otherwise you said this bypass JS verification when the tragedy

In the foreground with JS to make the restrictions and judgments in PHP to judge again otherwise you said this bypass JS verification when the tragedy
------------------------------------
If you judge again in the background, then you need to post more parameters to use as a judge and limit the variables. In this post process, there will be a manual URL input way to the input variable false. Eh, there is still a loophole!?

In the foreground with JS to make the restrictions and judgments in PHP to judge again otherwise you said this bypass JS verification when the tragedy
------------------------------------
If you judge again in the background, then you need to post more parameters to use as a judge and limit the variables. In this post process, there will be a manual URL input way to the input variable false. Eh, there is still a loophole!?





If the manually entered variables are compliant, should not worry about it?

In the foreground with JS to make the restrictions and judgments in PHP to judge again otherwise you said this bypass JS verification when the tragedy
------------------------------------
If you judge again in the background, then you need to post more parameters to use as a judge and limit the variables. In this post process, there will be a manual URL input way to the input variable false. Eh, there is still a loophole!?





If the manually entered variables are compliant, should not worry about it?
-----------------------------------
Manually entered variables are in compliance with the requirements, naturally no problem. The problem is that the user submits "illegal" data.

Danale, do you have any loopholes in the scheme?
At present, according to my judgment, the user can already get the value of "hidden" variable.

If you do it manually, hidden can get it right in the DOM node.

User submits "illegal" data how do you judge it to be illegal? Since it is illegal and can be judged, judged out after not continue to carry out ...

If you do it manually, hidden can get it right in the DOM node.

User submits "illegal" data how do you judge it to be illegal? Since it is illegal and can be judged, judged out after not continue to carry out ...
--------------------
The "illegal" conclusion is obtained by the subsequent manual analysis of the data.
According to your statement, the existing JS check to determine the "submit data value" on the basis of the corresponding verification back to PHP again. This scheme I think can try, the precondition is: I can based on the data in the background to re-export the foreground used to determine the parameter variables, rather than to submit the foreground parameter variables directly into the database after use.
This method is worth a try! This does not require you to record encryption key values in the session.

You must not directly enter the database before entering the database to detect if there is any code that might cause an injection attack

Unless it is a personal test station, there is no direct storage.

To Anglegz: You reply from the height of my doubts, but my application is b/s, changed to b/c is not possible;
To Anyilaoliu: interface Write security is a solution, the user manual URL way to submit the essence is to skip the Ajax check step directly to the backstage;
To AHUI_LCM: is required to log in, is currently logged in the user (not login is not able to submit), on the same machine to open an identical browser, manually submitted illegal data in the address bar.
To y244360439: Your link "then store this value with Sesseion, $_sesseion[' hash ') = $hash;
"How do you ensure that the stored procedure that writes the session is not called by the user alone?" I understand that writing the session process is also a post with parameters, which can also be manually submitted in the address bar, is not I understand it wrong?
Thank you, do you have any other suggestions? Session is the background randomly generated, will not be disturbed by the user, Discuz is also used this method, his many operations have Formharsh value, is this principle

Recently I was writing such a thing, there is no good way, parameters can be simulated, the background you how to limit it, the parameters are legitimate

Such a general CSRF

The parameters on the address bar, can be used $_post to? You use $_post in the program to receive only son data from the table. If he uses the address bar to input parameters directly, will $_post receive?

Simulation is another requirement, and absolute prevention is impossible.

It is possible to increase the difficulty. and requirements

I usually do that.

The specific code

Then there is no, is the final "?>" removed, so that the direct submission of the page will be due to grammatical errors and can not be executed
I can't read it.

To Y244360439:session is the background randomly generated, will not be disturbed by the user, Discuz is also used in this way, many of his operations have Formharsh value, this is the principle
---------------------------
I'd like to find a similar reference,
Only found the source of the swfupload, its processing for:
1) in the foreground call page js in the URL parameter assignment: "PHPSESSID": " "
2) Check and assign a value to SessionID in the background execution script:
Code for Session Cookie workaround
if (Isset ($_post["Phpsessid")) {
session_id ($_post["PHPSESSID"]);
} else if (Isset ($_get["Phpsessid")) {
session_id ($_get["PHPSESSID"]);
}
Really did not find in JS how to achieve "sesseion storage, $_sesseion[' hash '] = $hash"? Can you instruct me how to do this? No, download Discuz source code is pondering.
To AHUI_LCM: Read the commit code, get the variables are through the $_request[' xxx '] way, back to $_post, should be a big improvement of code. I am now learning to sell the dabbler of the missing vest:)

Do further instructions, you can look again, do not understand can be on the site Q I, http://www.ibihuo.com/show-60.html

You can do it yourself? A. Encrypt the decryption letter, for example:
Ajax submitted to?? URL http://localhost/a.php?key=REWTR54365EY&val=??

Where is the value of key used in PHP encryption? After the encryption (for example: self-defined encryption letter? To be submitted to the a.php), after submission to the letter of decryption? Get the value of the key (and then to submit the???) to see if it meets the requirements of this submission

In fact, you can use the encryption key, the same post to accept the page, in the Accept page to decrypt and verify key,

Use $_server["Http_referer" to determine if it is from your page. It is illegal to forge $_server["Http_referer". There's nothing technically cracked up.

Do further instructions, you can look again, do not understand can be on the site Q I, http://www.ibihuo.com/show-60.html
------------------------------------------
I'm going to try you to say encryption and decryption method, commit encryption through the AJAX variable data: "Hash=" +hash to achieve, but the client to get the background PHP generated $hash value I do not have a good way (my foreground and the background of the call is divided into 2 different files). Currently found to get background PHP generated $hash value of the method is also alone through the AJAX call, the personal feel that this acquisition process reduces the efficiency of the submission, but also may leak.
Can you tell me more about the $_sesseion[' hash ' and how did the front desk get it? Appreciate it!

1, only accept the submission with $_post, can make the URL parameter invalid
2. In the cookie, place the identifying word (including SessionID). But cookies are easy to access and do not guarantee security
3, the use of JS submission (including the dynamic addition of recognition words). General tools do not execute JS, the situation will be a little better. But we can't rule out the communication intervention after manual tracking.

1, only accept the submission with $_post, can make the URL parameter invalid
2. In the cookie, place the identifying word (including SessionID). But cookies are easy to access and do not guarantee security
3, the use of JS submission (including the dynamic addition of recognition words). General tools do not execute JS, the situation will be a little better. But we can't rule out the communication intervention after manual tracking.
---------------------------------------
1, only accept the submission with $_post, can make the URL parameter invalid
----> Previous AHUI_LCM mentioned, has been modified, for dealing with manual address illegal input is really effective.
2. In the cookie, place the identifying word (including SessionID). But cookies are easy to access and do not guarantee security
----> can be added in the back, although not to ensure safety, but also to increase the difficulty of being compromised.
3, the use of JS submission (including the dynamic addition of recognition words).
----> Increase the recognition word, consider the increase of verification code recognition method, later felt that the user operation will become a step more, affect the user feel, currently do not consider this method.
Brainstorming, thank you for your reply!

1, only accept the submission with $_post, can make the URL parameter invalid
2. In the cookie, place the identifying word (including SessionID). But cookies are easy to access and do not guarantee security
3, the use of JS submission (including the dynamic addition of recognition words). General tools do not execute JS, the situation will be a little better. But we can't rule out the communication intervention after manual tracking.

I am a novice php, moderator can be detailed about 2, 3 what is the meaning?

Do further instructions, you can look again, do not understand can be on the site Q I, http://www.ibihuo.com/show-60.html
------------------------------------------
I'm going to try you to say encryption and decryption method, commit encryption through the AJAX variable data: "Hash=" +hash to achieve, but the client to get the background PHP generated $hash value I do not have a good way (my foreground and the background of the call is divided into 2 different files). Currently found to get background PHP generated $hash value of the method is also alone through the AJAX call, the personal feel that this acquisition process reduces the efficiency of the submission, but also may leak.
Can you tell me more about the $_sesseion[' hash ' and how did the front desk get it? Appreciate it!

Pay hash value to foreground template via template engine

