


PHP prevents CC attack code PHP prevents frequent refresh of web pages
This article mainly introduces the code of PHP to prevent CC attacks and PHP to prevent frequent refresh of web pages, rapid and malicious refresh of web pages. CC attacks use proxy servers to generate legitimate requests directed to the target site, simulating multiple users to continuously access the victim website. , interested friends can study
Rapid malicious refresh of web pages, cc attack is that the attacker uses the proxy server to generate legitimate requests directed to the target site, simulating multiple users to continuously access the victim website, especially Accessing pages that require a large amount of data operations and a large amount of CPU time will eventually lead to the target website server resources being exhausted until it crashes. In this way, server resources are wasted, and the CPU is at 100% for a long time, and there is always processing. Endless connections occur until the network is congested and normal access is terminated. We call it a CC attack. Although we can use some anti-attack software to achieve this, the effect is sometimes not obvious.
Below I provide a piece of PHP code that can prevent CC attacks to a certain extent.
Main functions: Continuously refreshing the page more than 5 times within 3 seconds will point to the local http://127.0.0.1
Just put this code on the page that needs to prevent CC attacks. Can.
Source code
<?php $timestampcc = time(); $cc_nowtime = $timestampcc; if(session_is_registered('cc_lasttime')){ $cc_lasttime = $_SESSION['cc_lasttime']; $cc_times = $_SESSION['cc_times']+1; $_SESSION['cc_times'] = $cc_times; }else{ $cc_lasttime = $cc_nowtime; $cc_times = 1; $_SESSION['cc_times'] = $cc_times; $_SESSION['cc_lasttime'] = $cc_lasttime; } if(($cc_nowtime-$cc_lasttime)<3){//3秒内刷新5次以上可能为cc攻击 if($cc_times>=5){ echo '刷新太快!'; exit; } }else{ $cc_times = 0; $_SESSION['cc_lasttime'] = $cc_nowtime; $_SESSION['cc_times'] = $cc_times; } ?>
The following is an effective method for preventing CC attacks in PHP for everyone:
1 .session record
submit.php is the sending page. Set a session variable on this page and send it to the submitdeal.php page as a hidden field and form. On the server side, the hidden variable posted from the post is sent to the server. Compare the session variables recorded on the end. For example, if they are the same, write to the database and clear the session. In this way, when the user refreshes the page, if the two values are not equal, an error or jump will be prompted.
Advantages: No need for users to enter verification codes
Disadvantages: The form is easily copied
2 .Verification code
The principle is the same as the first one, except that the session data is not submitted as a hidden field, but is filled in by the user. Most websites use text verification codes and picture verification codes, and picture verification codes are highly secure. .
3.IP binding
After submitting the data, first retrieve the client IP from the IP table. If there is one and it has not expired, then an error will be reported, otherwise it will be written to the database, and then Then get the guest room IP and write the IP into the database.
4.cookie:After the client submits, the processing program first searches whether the client has set a cookie. If so, it will not submit again; if not, it will write the data and then write a cookie;
Example:
Users' meaningless frequent jumps and requests will put a lot of burden on the server. In fact, using cookies can prevent this.
<?php error_reporting(0); //if($_COOKIE["ck"])die("刷新过快!"); if($_COOKIE["ck"])header("Location:http://www.baidu.com");//这里如果用户刷新过快,给予终止php脚本或者直接302跳转 setcookie("ck","1",time()+3);//设定cookie存活时间3s echo "hello!"; ?>
Method one:
<?php session_start(); $k=$_GET['k']; $t=$_GET['t']; $allowTime = 1800;//防刷新时间 $ip = get_client_ip(); $allowT = md5($ip.$k.$t); if(!isset($_SESSION[$allowT])) { $refresh = true; $_SESSION[$allowT] = time(); }elseif(time() - $_SESSION[$allowT]>$allowTime){ $refresh = true; $_SESSION[$allowT] = time(); }else{ $refresh = false; } ?>
Method two:
<? session_start(); if(!emptyempty($_POST[name])){ $data = $_POST[name]; $tag = $_POST[tag]; if($_SESSION[status]==$tag){ echo $data; }else{ echo "不允许刷新!"; } } $v = mt_rand(1,10000); ?> <form method="post" name="magic" action="f5.php"><input type="hidden" name="tag" value="<?=$v?>"><input type=text name="name"><input type="submit" value="submit"> </form> <? echo $v; $_SESSION[status] = $v; ?>
Method three:
<? session_start(); if(!emptyempty($_POST[name])){ $data = $_POST[name]; $tag = $_POST[tag]; if($_SESSION[status]==$tag){ echo $data; }else{ echo "不允许刷新!"; } } $v = mt_rand(1,10000); ?> <form method="post" name="magic" action="f5.php"><input type="hidden" name="tag" value="<?=$v?>"><input type=text name="name"><input type="submit" value="submit"> </form> <? echo $v; $_SESSION[status] = $v; ?>
The above is php There are many ways to prevent CC attacks. I hope it can help everyone prevent web pages from being refreshed quickly and maliciously.
Related recommendations:
ThinkPHP’s method to prevent repeated submission of forms
Explanation of PHP’s method to prevent sql injection
The above is the detailed content of PHP prevents CC attack code PHP prevents frequent refresh of web pages. For more information, please follow other related articles on the PHP Chinese website!

TomodifydatainaPHPsession,startthesessionwithsession_start(),thenuse$_SESSIONtoset,modify,orremovevariables.1)Startthesession.2)Setormodifysessionvariablesusing$_SESSION.3)Removevariableswithunset().4)Clearallvariableswithsession_unset().5)Destroythe

Arrays can be stored in PHP sessions. 1. Start the session and use session_start(). 2. Create an array and store it in $_SESSION. 3. Retrieve the array through $_SESSION. 4. Optimize session data to improve performance.

PHP session garbage collection is triggered through a probability mechanism to clean up expired session data. 1) Set the trigger probability and session life cycle in the configuration file; 2) You can use cron tasks to optimize high-load applications; 3) You need to balance the garbage collection frequency and performance to avoid data loss.

Tracking user session activities in PHP is implemented through session management. 1) Use session_start() to start the session. 2) Store and access data through the $_SESSION array. 3) Call session_destroy() to end the session. Session tracking is used for user behavior analysis, security monitoring, and performance optimization.

Using databases to store PHP session data can improve performance and scalability. 1) Configure MySQL to store session data: Set up the session processor in php.ini or PHP code. 2) Implement custom session processor: define open, close, read, write and other functions to interact with the database. 3) Optimization and best practices: Use indexing, caching, data compression and distributed storage to improve performance.

PHPsessionstrackuserdataacrossmultiplepagerequestsusingauniqueIDstoredinacookie.Here'showtomanagethemeffectively:1)Startasessionwithsession_start()andstoredatain$_SESSION.2)RegeneratethesessionIDafterloginwithsession_regenerate_id(true)topreventsessi

In PHP, iterating through session data can be achieved through the following steps: 1. Start the session using session_start(). 2. Iterate through foreach loop through all key-value pairs in the $_SESSION array. 3. When processing complex data structures, use is_array() or is_object() functions and use print_r() to output detailed information. 4. When optimizing traversal, paging can be used to avoid processing large amounts of data at one time. This will help you manage and use PHP session data more efficiently in your actual project.

The session realizes user authentication through the server-side state management mechanism. 1) Session creation and generation of unique IDs, 2) IDs are passed through cookies, 3) Server stores and accesses session data through IDs, 4) User authentication and status management are realized, improving application security and user experience.


Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

SublimeText3 English version
Recommended: Win version, supports code prompts!

SecLists
SecLists is the ultimate security tester's companion. It is a collection of various types of lists that are frequently used during security assessments, all in one place. SecLists helps make security testing more efficient and productive by conveniently providing all the lists a security tester might need. List types include usernames, passwords, URLs, fuzzing payloads, sensitive data patterns, web shells, and more. The tester can simply pull this repository onto a new test machine and he will have access to every type of list he needs.

Dreamweaver Mac version
Visual web development tools

Notepad++7.3.1
Easy-to-use and free code editor

PhpStorm Mac version
The latest (2018.2.1) professional PHP integrated development tool
