PHP prevents CC attack code PHP prevents frequent refresh of web pages, _PHP tutorial

php prevents CC attack code php prevents frequent refresh of web pages,

rapid and malicious refresh of web pages, CC attack is when the attacker uses a proxy server to generate legitimate requests directed to the target site, simulating multiple users Continuously accessing the victim website, especially those pages that require a large amount of data operations and require a lot of CPU time, will eventually lead to the target website server resources being exhausted, until it crashes. This will cause a waste of server resources and CPU If it stays at 100% for a long time, there will always be connections that cannot be processed until the network is congested and normal access is suspended. We call it a CC attack. Although we can use some anti-attack software to achieve this, the effect is sometimes not obvious.

Below I provide a piece of PHP code that can prevent CC attacks to a certain extent.
Main functions: Continuously refreshing the page more than 5 times within 3 seconds will point to this machine http://127.0.0.1
Just put this code on the page that needs to prevent CC attacks.
Source code

<&#63;php
$timestampcc = time();
$cc_nowtime = $timestampcc;
if(session_is_registered('cc_lasttime')){
 $cc_lasttime = $_SESSION['cc_lasttime'];
 $cc_times = $_SESSION['cc_times']+1;
 $_SESSION['cc_times'] = $cc_times;
}else{
 $cc_lasttime = $cc_nowtime;
 $cc_times = 1;
 $_SESSION['cc_times'] = $cc_times;
 $_SESSION['cc_lasttime'] = $cc_lasttime;
} 
if(($cc_nowtime-$cc_lasttime)<3){//3秒内刷新5次以上可能为cc攻击
 if($cc_times>=5){
 echo '刷新太快!';
 exit;
 }
}else{
 $cc_times = 0;
 $_SESSION['cc_lasttime'] = $cc_nowtime;
 $_SESSION['cc_times'] = $cc_times;
} 
&#63;>

The following is an effective method for preventing CC attacks in PHP:

1.session record
submit.php is the sending page. Set a session variable on this page and send it to the submitdeal.php page as a hidden field and form. On the server side, compare the hidden variable posted with the session variable recorded on the server side, for example If the two values ​​are the same, write to the database and clear the session. If the user refreshes the page, an error or jump will be prompted if the two values ​​are not equal.
Advantages: No need for user to enter verification code
Disadvantages: The form is easily copied
2.Verification code
The principle is the same as the first one, except that the session data is not submitted as a hidden field, but is asked to be filled in by the user. Most websites use text verification codes and picture verification codes, and picture verification codes are highly secure.

3.IP binding
After submitting the data, first retrieve the client IP from the IP table. If it exists and has not expired, an error will be reported. Otherwise, it will be written to the database. Then the guest room IP will be retrieved and the IP will be written to the database.
4.cookie:After the client submits, the processing program first searches whether the client has set a cookie. If so, it will not submit again; if not, it will write the data and then write a cookie;
Example:

Users' meaningless frequent jumps and requests will put a lot of burden on the server. In fact, using cookies can prevent this.

<&#63;php 
error_reporting(0); 
//if($_COOKIE["ck"])die("刷新过快！"); 
if($_COOKIE["ck"])header("Location:http://www.baidu.com");//这里如果用户刷新过快，给予终止php脚本或者直接302跳转 
setcookie("ck","1",time()+3);//设定cookie存活时间3s 
echo "hello!"; 
&#63;>

Method 1:

<&#63;php  
session_start();  
$k=$_GET['k'];  
$t=$_GET['t'];  
$allowTime = 1800;//防刷新时间  
$ip = get_client_ip();  
$allowT = md5($ip.$k.$t);  
if(!isset($_SESSION[$allowT]))  
{  
 $refresh = true;  
 $_SESSION[$allowT] = time();  
}elseif(time() - $_SESSION[$allowT]>$allowTime){  
 $refresh = true;  
 $_SESSION[$allowT] = time();  
}else{  
 $refresh = false;  
}  
&#63;> 

Method 2:

<&#63; 
session_start(); 
if(!emptyempty($_POST[name])){ 
 $data = $_POST[name]; 
 $tag = $_POST[tag]; 
 if($_SESSION[status]==$tag){ 
 echo $data; 
 }else{ 
 echo "不允许刷新！"; 
 } 
} 
$v = mt_rand(1,10000); 
&#63;> 
<form method="post" name="magic" action="f5.php"><input type="hidden" 
name="tag" value="<&#63;=$v&#63;>"><input type=text name="name"><input type="submit" value="submit"> 
</form> 
<&#63; 
echo $v; 
$_SESSION[status] = $v; 
&#63;> 

Method 3:

<&#63; 
session_start(); 
if(!emptyempty($_POST[name])){ 
 $data = $_POST[name]; 
 $tag = $_POST[tag]; 
 if($_SESSION[status]==$tag){ 
 echo $data; 
 }else{ 
 echo "不允许刷新！"; 
 } 
} 
$v = mt_rand(1,10000); 
&#63;> 
<form method="post" name="magic" action="f5.php"><input type="hidden" 
name="tag" value="<&#63;=$v&#63;>"><input type=text name="name"><input type="submit" value="submit"> 
</form> 
<&#63; 
echo $v; 
$_SESSION[status] = $v; 
&#63;> 

The above are various ways for PHP to prevent CC attacks. I hope it can help everyone prevent quick and malicious refreshes of web pages.

Articles you may be interested in:

• Let PHP COOKIE take effect immediately and use it without refreshing
• Summary of the code in php to prevent malicious page refreshes
• PHP methods to prevent malicious refreshes and ticket fraud
• A summary of PHP methods to prevent the website from being refreshed
• Refresh the PHP buffer to speed up your site
• PHP prevents refreshing of repeatedly submitted pages The sample code
• php uses session to prevent repeated page refresh

http://www.bkjia.com/PHPjc/1084589.htmlwww.bkjia.comtruehttp: //www.bkjia.com/PHPjc/1084589.htmlTechArticlephp prevents CC attack code php prevents frequent refresh of web pages, rapid and malicious refresh of web pages, CC attacks are attackers using proxy servers Generate legitimate requests to the target site, simulating multiple users...