Re: script to check if form is submitted from the same page?
| From: | Richard Lynch | Date: | Sat, 12 Aug 2006 21:02:24 +0000 |
| Subject: | Re: script to check if form is submitted from the same page? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-240569@lists.php.net to get a copy of this message | ||
On Sat, August 12, 2006 1:55 pm, Afan Pasalic wrote:
> could I use this code to check if form is submitted from the same
> page/same domain
>
> if ($_POST['form_submitted'] == 'Yes')
> {
> if (preg_match($_SERVER['HTTP_HOST'], $_SERVER["HTTP_REFERER"]) ==
> 0)
> {
> die ('^&%*^%#@#');
> }
> }
No.
HTTP_REFERER is completely unreliable.
If you want to be sure of the source of your POST data coming from
your form, you need to send a unique unpredictable token in the FORM,
and log it when you send the FORM, and then compare what comes back.
--
Like Music?
http://l-i-e.com/artists.htm