Re: Form Handler Script Security Discussion
| From: | cajbecu | Date: | Thu, 29 Mar 2007 15:13:03 +0000 |
| Subject: | Re: Form Handler Script Security Discussion | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-251629@lists.php.net to get a copy of this message | ||
>
> <?
> if($_POST &&
> eregi(getenv("SERVER_NAME"),getenv("HTTP_REFERER"))) {
> // This is a safe POST
> } elseif(!eregi(getenv("SERVER_NAME"),getenv("HTTP_REFERER"))) {
> die("Illegal access. Your IP has been logged.\n");
> }
> ?>
>
it is not safe. i can use curl (www.php.net/curl) and modify the referer
of my script to pass this security check. i advise you to add image code
to the form and check that in your script. that will stop the attackers
insert lot of data in your database.