note 59937 deleted from function.md5 by peehaa
| From: | peehaa@php.net | Date: | Fri, 12 Jul 2013 16:20:20 +0000 |
| Subject: | note 59937 deleted from function.md5 by peehaa | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-195590@lists.php.net to get a copy of this message | ||
Note Submitter: rick.gaither
----
This is a nifty function to help in securing your web-forms.
If no argument is passed the function will return an encrypted hex code representing the second it
was called. If the same hex code is passed to the function it will return the number of seconds that
have elapsed. The php script can then check the time between accessing the web-page and submitting
the POST. This thwarts script ran web-form submissions. The program can verify a suitable period has
elapsed for expected manual entries. The time check can be from 1 second to about 17 hours.
The function requires the latest PEAR Blowfish Encryption module.
This would go in the form:
<?php print "<input type='hidden' value='" . FormTimer() .
"' name='FormCode'>"; ?>
This would go in the main php (post) script:
<?php
$seconds = FormTimer($_POST['FormCode']);
if (($seconds < 10) || ($seconds > 1900)) { die "Your entry time took less than 10
seconds or more than 30 minutes"; }
?>
Function...
<?php
function FormTimer($CodeID="") {
require ('Blowfish.php');
require ('Blowfish/DefaultKey.php');
$key = "Secret^Word";
$bf = new Crypt_Blowfish($key);
$current = substr(sprintf("%d", (time()+1)),-8);
if (!$CodeID) { return bin2hex($bf->encrypt($current)); }
$len = strlen($CodeID); $cValue = -1;
for ($i=0;$i<$len;$i+=2) $Crypt.=chr(hexdec(substr($CodeID,$i,2)));
if ($Crypt) {
$time_called = $bf->decrypt($Crypt);
if ($time_called) { $cValue = (intval($current) - intval($time_called)); }
}
return $cValue;
}
?>