想到一个有关问题：代码有没有必要做ajax请求判断 -PHP Tutorial-php.cn

Home

Backend Development

PHP Tutorial

想到一个有关问题：代码有没有必要做ajax请求判断

WBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWB

Jun 13, 2016 pm 12:54 PM

ajaxcontentiframenbspphp

想到一个问题：代码有没有必要做ajax请求判断
以前做ajax都没做过是否是ajax请求的判断。
有个新同事说要做判断，才注意到这个。
我查了很多站点像优酷
他们都没做ajax获取的判断。
是否有必要做这个判断呢。

ajax ?php
------解决方案--------------------
最好做，一般ajax请求的返回数据要求要高些
------解决方案--------------------

引用:

引用:最好做，一般ajax请求的返回数据要求要高些
我觉得做了最好
不做也无妨，之前这样认为请求的结果也是要呈现的。

为什么像优酷这样的站点不做这个限制呢

谢谢版主大哥的回答

要看什么情况了，比如你的网站支持发布一个消息的功能，而这个是ajax请求，同时get方式传参即可。比如：msg.php?content=test。

那么如果你不做ajax判断的话，同时你的站点又是很火的那种站点（比如微博等），那么我就可以恶意攻击，在我的网站下面插入一个iframe，而这个iframe指向的是msg.php?content=我被攻击了，那么一旦你访问我的站点，在你不知道的情况下，其实你的微博已经更新了一条消息“我被攻击了”，这是最常见的也是最简单的csrf攻击。

有的严重其实攻击渗透到银行流程中去，所以看你的需求了，ajax我建议还是做判断吧，最起码也要refer判断一下吧~
现在有些网站这种漏洞还是很严重的，两周前我还发现了一个已知的国内大型网站的这种漏洞，只要我在论坛里面发个帖子说大家都来看看（那个地址是我自己的测试服务器url），然后这个网站的一个投票数就会自动增多，很多人都在不知情的情况下帮我投票。。。

真心建议，做个判断吧~
------解决方案--------------------
关键看需求，程序说到底就是接收一个请求，返回一个结果
如果是可预见合理请求（在其他层次已经处理了不合理情况），就没必要在这个层次再判断
如果不可预见是否合理，则就算不是ajax也要做各种判断
例如表单提交，虽然客户端javascript做了判断，但仍然不能确定是否恶意提交

如果返回是面向一个特定的请求，例如API，那么肯定要检查的
至于攻击之类，难道不是ajax就不防范么？

记住一个原则：易入难出

Statement

The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

How to calculate the total number of elements in a PHP multidimensional array?May 15, 2025 pm 09:00 PM

Calculating the total number of elements in a PHP multidimensional array can be done using recursive or iterative methods. 1. The recursive method counts by traversing the array and recursively processing nested arrays. 2. The iterative method uses the stack to simulate recursion to avoid depth problems. 3. The array_walk_recursive function can also be implemented, but it requires manual counting.

What are the characteristics of do-while loops in PHP?May 15, 2025 pm 08:57 PM

In PHP, the characteristic of a do-while loop is to ensure that the loop body is executed at least once, and then decide whether to continue the loop based on the conditions. 1) It executes the loop body before conditional checking, suitable for scenarios where operations need to be performed at least once, such as user input verification and menu systems. 2) However, the syntax of the do-while loop can cause confusion among newbies and may add unnecessary performance overhead.

How to hash strings in PHP?May 15, 2025 pm 08:54 PM

Efficient hashing strings in PHP can use the following methods: 1. Use the md5 function for fast hashing, but is not suitable for password storage. 2. Use the sha256 function to improve security. 3. Use the password_hash function to process passwords to provide the highest security and convenience.

How to implement array sliding window in PHP?May 15, 2025 pm 08:51 PM

Implementing an array sliding window in PHP can be done by functions slideWindow and slideWindowAverage. 1. Use the slideWindow function to split an array into a fixed-size subarray. 2. Use the slideWindowAverage function to calculate the average value in each window. 3. For real-time data streams, asynchronous processing and outlier detection can be used using ReactPHP.

How to use the __clone method in PHP?May 15, 2025 pm 08:48 PM

The __clone method in PHP is used to perform custom operations when object cloning. When cloning an object using the clone keyword, if the object has a __clone method, the method will be automatically called, allowing customized processing during the cloning process, such as resetting the reference type attribute to ensure the independence of the cloned object.

How to use goto statements in PHP?May 15, 2025 pm 08:45 PM

In PHP, goto statements are used to unconditionally jump to specific tags in the program. 1) It can simplify the processing of complex nested loops or conditional statements, but 2) Using goto may make the code difficult to understand and maintain, and 3) It is recommended to give priority to the use of structured control statements. Overall, goto should be used with caution and best practices are followed to ensure the readability and maintainability of the code.

How to implement data statistics in PHP?May 15, 2025 pm 08:42 PM

In PHP, data statistics can be achieved by using built-in functions, custom functions, and third-party libraries. 1) Use built-in functions such as array_sum() and count() to perform basic statistics. 2) Write custom functions to calculate complex statistics such as medians. 3) Use the PHP-ML library to perform advanced statistical analysis. Through these methods, data statistics can be performed efficiently.

How to use anonymous functions in PHP?May 15, 2025 pm 08:39 PM

Yes, anonymous functions in PHP refer to functions without names. They can be passed as parameters to other functions and as return values of functions, making the code more flexible and efficient. When using anonymous functions, you need to pay attention to scope and performance issues.

See all articles