search
HomeBackend DevelopmentPHP TutorialHow to use PHP to obtain referer and determine the source to prevent illegal access

This article will introduce to you how to use PHP to obtain the referer to determine the source to prevent illegal access? It has certain reference value. Friends in need can refer to it. I hope it will be helpful to everyone.

How to use PHP to obtain referer and determine the source to prevent illegal access

The php code of download page down.php Now I found that if I open it directly with Thunder or Google Chrome, the downloaded file can be output, and it has no anti-leeching effect at all. Now I want to allow only those connected to my own site to use it directly. Those connected to other sites and those who directly enter this address will jump to the copy.htm page.

The $_SERVER["HTTP_REFERER"] predefined server variable in PHP can determine the source.

$_SESSION['HTTP_REFERER'] can obtain the source address of the previous connection of the current link, that is, the URL address of the previous page linked to the current page.
It is generally used to determine where the viewer clicked the link to jump to this page, that is, the so-called origin. It can also be used to prevent hotlinking by determining the origin.
For example:

<?php
 $url_array = parse_url($_SESSION[&#39;HTTP_REFERER&#39;]); 
 //如果页面的域名不是服务器域名,就连接到登陆窗口 
 if($_SERVER[&#39;HTTP_HOST&#39;] != $url_array["host"]) { 
 header("location: login.php"); 
 exit; 
 } 
 ?>

Recently there is a project that needs to prevent users from illegally accessing a json page. The basic solution is to determine the source to restrict non-call access:

$_SERVER[‘HTTP_REFERER’]:来路链接,可能带尾巴(如: 
可以通过php内置函数parse_url()来获取到当前网址(www.httple.net),即:
$refererUrl = parse_url($_SERVER[‘HTTP_REFERER’]);
$host = $refererUrl[‘host’];
$host的值即为来路的网址(www.httple.net)。
获取到了来路的网址之后,我们就可以通过这个网址来限制访问该页面的权限了。代码如下:
if(!isset($_SERVER[‘HTTP_REFERER’]) || $referurl[‘host’] !=”www.httple.net”) { header(“location: /”); 
//如果没有来路,或者来路不是本站,跳转到首页。 exit; }

Putting this line of code at the top of the json data page can easily solve this problem.

Defects of this processing method: the normal data of the page can be obtained through forged sources.

Related code

The method of getting the source Url mainly uses the HTTP_REFERER function in the server variable. The code is pasted:

function get_referer(){   
$url = $_SERVER["HTTP_REFERER"]; //获取完整的来路URL   
$str = str_replace("http://","",$url); //去掉http://   
$strdomain = explode("/",$str); // 以“/”分开成数组   
$domain = $strdomain[0]; //取第一个“/”以前的字符  
return $domain;  
}   

//对于百度、谷歌搜索引擎来路判断   
function get_seo(){  
$s = 0;   
if(strstr(get_referer(),&#39;baidu.com&#39;)){   
$s = 1;   
}   
else if(strstr(get_referer(),&#39;google.com.hk&#39;)){   
$s = 1;   
}   
return $se;    
}

php website Get the source Url The method mainly uses the HTTP_REFERER function in the server variable. The code is pasted:

function get_referer(){
$url = $_SERVER["HTTP_REFERER"]; //获取完整的来路URL
$str = str_replace(“http://”,””,$url); //去掉http://
$strdomain = explode(“/”,$str); // 以“/”分开成数组
$domain = $strdomain[0]; //取第一个“/”以前的字符
return $domain;
}

//对于百度、谷歌搜索引擎来路判断
function get_seo(){
$s = 0;
if(strstr(get_referer(),’baidu.com’)){
$s = 1;
}
else if(strstr(get_referer(),’google.com.hk’)){
$s = 1;
}
return $se;
}

When processing a form, you have to consider Discuz has already judged the possibility of static submission by users based on formhash

Here I use another way to determine the origin of the page. Of course, this method can also be used to forge the origin of HTTP_REFERER

The second part is to solve the problem that header('location: in PHP cannot get HTTP_REFERER for the next page after jumping to the page. Here we can only add a link to the page and then use js to simulate clicking the link, so that the next page will definitely Received HTTP_REFERER. Keyword: document.getElementById('gourl').click();

Recommended learning: php video tutorial

The above is the detailed content of How to use PHP to obtain referer and determine the source to prevent illegal access. For more information, please follow other related articles on the PHP Chinese website!

Statement
This article is reproduced at:CSDN. If there is any infringement, please contact admin@php.cn delete
What are some common problems that can cause PHP sessions to fail?What are some common problems that can cause PHP sessions to fail?Apr 25, 2025 am 12:16 AM

Reasons for PHPSession failure include configuration errors, cookie issues, and session expiration. 1. Configuration error: Check and set the correct session.save_path. 2.Cookie problem: Make sure the cookie is set correctly. 3.Session expires: Adjust session.gc_maxlifetime value to extend session time.

How do you debug session-related issues in PHP?How do you debug session-related issues in PHP?Apr 25, 2025 am 12:12 AM

Methods to debug session problems in PHP include: 1. Check whether the session is started correctly; 2. Verify the delivery of the session ID; 3. Check the storage and reading of session data; 4. Check the server configuration. By outputting session ID and data, viewing session file content, etc., you can effectively diagnose and solve session-related problems.

What happens if session_start() is called multiple times?What happens if session_start() is called multiple times?Apr 25, 2025 am 12:06 AM

Multiple calls to session_start() will result in warning messages and possible data overwrites. 1) PHP will issue a warning, prompting that the session has been started. 2) It may cause unexpected overwriting of session data. 3) Use session_status() to check the session status to avoid repeated calls.

How do you configure the session lifetime in PHP?How do you configure the session lifetime in PHP?Apr 25, 2025 am 12:05 AM

Configuring the session lifecycle in PHP can be achieved by setting session.gc_maxlifetime and session.cookie_lifetime. 1) session.gc_maxlifetime controls the survival time of server-side session data, 2) session.cookie_lifetime controls the life cycle of client cookies. When set to 0, the cookie expires when the browser is closed.

What are the advantages of using a database to store sessions?What are the advantages of using a database to store sessions?Apr 24, 2025 am 12:16 AM

The main advantages of using database storage sessions include persistence, scalability, and security. 1. Persistence: Even if the server restarts, the session data can remain unchanged. 2. Scalability: Applicable to distributed systems, ensuring that session data is synchronized between multiple servers. 3. Security: The database provides encrypted storage to protect sensitive information.

How do you implement custom session handling in PHP?How do you implement custom session handling in PHP?Apr 24, 2025 am 12:16 AM

Implementing custom session processing in PHP can be done by implementing the SessionHandlerInterface interface. The specific steps include: 1) Creating a class that implements SessionHandlerInterface, such as CustomSessionHandler; 2) Rewriting methods in the interface (such as open, close, read, write, destroy, gc) to define the life cycle and storage method of session data; 3) Register a custom session processor in a PHP script and start the session. This allows data to be stored in media such as MySQL and Redis to improve performance, security and scalability.

What is a session ID?What is a session ID?Apr 24, 2025 am 12:13 AM

SessionID is a mechanism used in web applications to track user session status. 1. It is a randomly generated string used to maintain user's identity information during multiple interactions between the user and the server. 2. The server generates and sends it to the client through cookies or URL parameters to help identify and associate these requests in multiple requests of the user. 3. Generation usually uses random algorithms to ensure uniqueness and unpredictability. 4. In actual development, in-memory databases such as Redis can be used to store session data to improve performance and security.

How do you handle sessions in a stateless environment (e.g., API)?How do you handle sessions in a stateless environment (e.g., API)?Apr 24, 2025 am 12:12 AM

Managing sessions in stateless environments such as APIs can be achieved by using JWT or cookies. 1. JWT is suitable for statelessness and scalability, but it is large in size when it comes to big data. 2.Cookies are more traditional and easy to implement, but they need to be configured with caution to ensure security.

See all articles

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

PhpStorm Mac version

PhpStorm Mac version

The latest (2018.2.1) professional PHP integrated development tool

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Linux new version

SublimeText3 Linux new version

SublimeText3 Linux latest version

mPDF

mPDF

mPDF is a PHP library that can generate PDF files from UTF-8 encoded HTML. The original author, Ian Back, wrote mPDF to output PDF files "on the fly" from his website and handle different languages. It is slower than original scripts like HTML2FPDF and produces larger files when using Unicode fonts, but supports CSS styles etc. and has a lot of enhancements. Supports almost all languages, including RTL (Arabic and Hebrew) and CJK (Chinese, Japanese and Korean). Supports nested block-level elements (such as P, DIV),

SAP NetWeaver Server Adapter for Eclipse

SAP NetWeaver Server Adapter for Eclipse

Integrate Eclipse with SAP NetWeaver application server.