Making sure a post request came from your site
| From: | Chris Boget | Date: | Fri, 05 Apr 2002 17:58:51 +0000 |
| Subject: | Making sure a post request came from your site | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-91760@lists.php.net to get a copy of this message | ||
For security, you can modify your code so that you check
the $_POST elements instead of using the magic globals.
That's all well and good.
However, someone copy and save your HTML to their local
machine, change some values, change the "Action" page of the
form to be http://www.yoursite.com/form_page.php
instead of
"form_page.php". You'll be checking the $_POST elements
but you won't have any idea that they were changed and posted
from the user's local machine.
Is there any way to determine from where the post request came
from w/o using http_referer?
Chris