


How to use PHP to obtain referer and determine the source to prevent illegal access
This article will introduce to you how to use PHP to obtain the referer to determine the source to prevent illegal access? It has certain reference value. Friends in need can refer to it. I hope it will be helpful to everyone.
The php code of download page down.php Now I found that if I open it directly with Thunder or Google Chrome, the downloaded file can be output, and it has no anti-leeching effect at all. Now I want to allow only those connected to my own site to use it directly. Those connected to other sites and those who directly enter this address will jump to the copy.htm page.
The $_SERVER["HTTP_REFERER"] predefined server variable in PHP can determine the source.
$_SESSION['HTTP_REFERER'] can obtain the source address of the previous connection of the current link, that is, the URL address of the previous page linked to the current page.
It is generally used to determine where the viewer clicked the link to jump to this page, that is, the so-called origin. It can also be used to prevent hotlinking by determining the origin.
For example:
<?php $url_array = parse_url($_SESSION['HTTP_REFERER']); //如果页面的域名不是服务器域名,就连接到登陆窗口 if($_SERVER['HTTP_HOST'] != $url_array["host"]) { header("location: login.php"); exit; } ?>
Recently there is a project that needs to prevent users from illegally accessing a json page. The basic solution is to determine the source to restrict non-call access:
$_SERVER[‘HTTP_REFERER’]:来路链接,可能带尾巴(如: 可以通过php内置函数parse_url()来获取到当前网址(www.httple.net),即: $refererUrl = parse_url($_SERVER[‘HTTP_REFERER’]); $host = $refererUrl[‘host’]; $host的值即为来路的网址(www.httple.net)。 获取到了来路的网址之后,我们就可以通过这个网址来限制访问该页面的权限了。代码如下: if(!isset($_SERVER[‘HTTP_REFERER’]) || $referurl[‘host’] !=”www.httple.net”) { header(“location: /”); //如果没有来路,或者来路不是本站,跳转到首页。 exit; }
Putting this line of code at the top of the json data page can easily solve this problem.
Defects of this processing method: the normal data of the page can be obtained through forged sources.
Related code
The method of getting the source Url mainly uses the HTTP_REFERER function in the server variable. The code is pasted:
function get_referer(){ $url = $_SERVER["HTTP_REFERER"]; //获取完整的来路URL $str = str_replace("http://","",$url); //去掉http:// $strdomain = explode("/",$str); // 以“/”分开成数组 $domain = $strdomain[0]; //取第一个“/”以前的字符 return $domain; } //对于百度、谷歌搜索引擎来路判断 function get_seo(){ $s = 0; if(strstr(get_referer(),'baidu.com')){ $s = 1; } else if(strstr(get_referer(),'google.com.hk')){ $s = 1; } return $se; }
php website Get the source Url The method mainly uses the HTTP_REFERER function in the server variable. The code is pasted:
function get_referer(){ $url = $_SERVER["HTTP_REFERER"]; //获取完整的来路URL $str = str_replace(“http://”,””,$url); //去掉http:// $strdomain = explode(“/”,$str); // 以“/”分开成数组 $domain = $strdomain[0]; //取第一个“/”以前的字符 return $domain; } //对于百度、谷歌搜索引擎来路判断 function get_seo(){ $s = 0; if(strstr(get_referer(),’baidu.com’)){ $s = 1; } else if(strstr(get_referer(),’google.com.hk’)){ $s = 1; } return $se; }
When processing a form, you have to consider Discuz has already judged the possibility of static submission by users based on formhash
Here I use another way to determine the origin of the page. Of course, this method can also be used to forge the origin of HTTP_REFERER
The second part is to solve the problem that header('location: in PHP cannot get HTTP_REFERER for the next page after jumping to the page. Here we can only add a link to the page and then use js to simulate clicking the link, so that the next page will definitely Received HTTP_REFERER. Keyword: document.getElementById('gourl').click();
Recommended learning: php video tutorial
The above is the detailed content of How to use PHP to obtain referer and determine the source to prevent illegal access. For more information, please follow other related articles on the PHP Chinese website!

Reasons for PHPSession failure include configuration errors, cookie issues, and session expiration. 1. Configuration error: Check and set the correct session.save_path. 2.Cookie problem: Make sure the cookie is set correctly. 3.Session expires: Adjust session.gc_maxlifetime value to extend session time.

Methods to debug session problems in PHP include: 1. Check whether the session is started correctly; 2. Verify the delivery of the session ID; 3. Check the storage and reading of session data; 4. Check the server configuration. By outputting session ID and data, viewing session file content, etc., you can effectively diagnose and solve session-related problems.

Multiple calls to session_start() will result in warning messages and possible data overwrites. 1) PHP will issue a warning, prompting that the session has been started. 2) It may cause unexpected overwriting of session data. 3) Use session_status() to check the session status to avoid repeated calls.

Configuring the session lifecycle in PHP can be achieved by setting session.gc_maxlifetime and session.cookie_lifetime. 1) session.gc_maxlifetime controls the survival time of server-side session data, 2) session.cookie_lifetime controls the life cycle of client cookies. When set to 0, the cookie expires when the browser is closed.

The main advantages of using database storage sessions include persistence, scalability, and security. 1. Persistence: Even if the server restarts, the session data can remain unchanged. 2. Scalability: Applicable to distributed systems, ensuring that session data is synchronized between multiple servers. 3. Security: The database provides encrypted storage to protect sensitive information.

Implementing custom session processing in PHP can be done by implementing the SessionHandlerInterface interface. The specific steps include: 1) Creating a class that implements SessionHandlerInterface, such as CustomSessionHandler; 2) Rewriting methods in the interface (such as open, close, read, write, destroy, gc) to define the life cycle and storage method of session data; 3) Register a custom session processor in a PHP script and start the session. This allows data to be stored in media such as MySQL and Redis to improve performance, security and scalability.

SessionID is a mechanism used in web applications to track user session status. 1. It is a randomly generated string used to maintain user's identity information during multiple interactions between the user and the server. 2. The server generates and sends it to the client through cookies or URL parameters to help identify and associate these requests in multiple requests of the user. 3. Generation usually uses random algorithms to ensure uniqueness and unpredictability. 4. In actual development, in-memory databases such as Redis can be used to store session data to improve performance and security.

Managing sessions in stateless environments such as APIs can be achieved by using JWT or cookies. 1. JWT is suitable for statelessness and scalability, but it is large in size when it comes to big data. 2.Cookies are more traditional and easy to implement, but they need to be configured with caution to ensure security.


Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

PhpStorm Mac version
The latest (2018.2.1) professional PHP integrated development tool

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Linux new version
SublimeText3 Linux latest version

mPDF
mPDF is a PHP library that can generate PDF files from UTF-8 encoded HTML. The original author, Ian Back, wrote mPDF to output PDF files "on the fly" from his website and handle different languages. It is slower than original scripts like HTML2FPDF and produces larger files when using Unicode fonts, but supports CSS styles etc. and has a lot of enhancements. Supports almost all languages, including RTL (Arabic and Hebrew) and CJK (Chinese, Japanese and Korean). Supports nested block-level elements (such as P, DIV),

SAP NetWeaver Server Adapter for Eclipse
Integrate Eclipse with SAP NetWeaver application server.
