The principle of preventing a malicious page from being brushed is
Requires a validation string to be passed between pages,
Randomly generates a string when the page is generated,
As a must parameter is passed in all connections. This string is also stored in the session.
Point connection or form into the page, to determine whether the session verification code is the same as the user submitted, if the same, then the processing, not the same is considered a repeating refresh.
A verification code will be regenerated after processing is completed for the generation of the new page
Code
Copy CodeThe code is as follows:
Session_Start ();
$k =$_get[' K '];
$t =$_get[' t '];
$allowTime = 1800;//anti-refresh Time
$ip = Get_client_ip ();
$allowT = MD5 ($ip. $k. $t);
if (!isset ($_session[$allowT]))
{
$refresh = true;
$_session[$allowT] = time ();
}elseif (Time ()-$_session[$allowT]> $allowTime) {
$refresh = true;
$_session[$allowT] = time ();
}else{
$refresh = false;
}
?>
IE6 submitted two times I have also encountered, is generally used in the picture instead of submit, the picture has a submit (), this will be submitted two times, if only submit button I did not encounter the submission two times the situation.
Now tidy up:
The method is basically the same as the previous few.
The received page is 2.php divided into two parts, part of the processing of the variables submitted, part of the display page
The processing variable is completed with the header ("Location:". $_server[' php_self ') to jump to its own page
This section has to be judged if there are no post variables to skip. Of course, you can also jump to other pages.
Jumping to another page will have a problem when you return, it is recommended to do in a PHP file.
If the previous page passes through the variable does not meet the requirements can be forced to return
Copy CodeThe code is as follows:
Only said a general idea, perhaps the master will not encounter such problems, but not everyone is a master.
The 2.php process
Copy CodeThe code is as follows:
if (Isset ($_post))
{Receive variable
If (variable does not meet the requirements)
Else
Manipulating data
...
if (operation completed)
Header ("Location:". $_server[' php_self ');
}
http://www.bkjia.com/PHPjc/326178.html www.bkjia.com true http://www.bkjia.com/PHPjc/326178.html techarticle the principle of preventing a malicious brush page is to require a validation string to be passed between pages, randomly generating a string when generating a page, as a must parameter in all connections ...
