Security analysis of anti-shaking and anti-duplicate submission in PHP

Security Analysis of Anti-Shake and Anti-Double Submission in PHP

Introduction:
With the development of websites and applications, Web forms have become the One of the important ways of user interaction. After the user fills out the form and clicks the submit button, the server will receive and process the submitted data. However, due to network delays or user misoperations, the form may be submitted multiple times. Repeated submissions will not only increase the load on the server, but may also cause various security issues, such as repeated data insertion, unauthorized operations, etc. In order to solve these problems, we can use anti-shake and anti-duplicate submission technologies.

1. Principle and implementation of anti-shake
Anti-shake is a technology for processing manual trigger events. Its principle is to set a delay time after the trigger event. Only within this delay time will it not occur again. Only when an event is triggered will the corresponding operation be performed. If the event is triggered again within the delay time, the timer will be restarted, and the operation will not be performed until the event is not triggered again within the delay time.

In PHP, we can implement anti-shake function through JavaScript and AJAX. First, in the front-end page, we use JavaScript to listen for the form submission event and prevent the form's default submission behavior. Then, use AJAX technology to send the form data to a background PHP program for processing. In PHP programs, we can implement the anti-shake function by setting a delay time. The corresponding operation will only be performed if the same request is not received again within the delay time.

The following is a specific sample code:

<script>
    var timer; // 定时器

    document.getElementById("submitBtn").addEventListener("click", function(event) {
        event.preventDefault(); // 阻止表单的默认提交行为
        
        clearTimeout(timer); // 清除之前的定时器
        
        timer = setTimeout(function() {
            // 发送 AJAX 请求
            var xhr = new XMLHttpRequest();
            xhr.open("POST", "handle_form.php", true);
            xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
            xhr.onreadystatechange = function() {
                if (xhr.readyState == 4 && xhr.status == 200) {
                    console.log(xhr.responseText);
                }
            };
            xhr.send(new FormData(document.getElementById("form")));
        }, 500); // 延迟时间设置为 500 毫秒
    });
</script>

In this example, we use the setTimeout function to set a timer with a delay of 500 milliseconds. Each time the submit button is clicked, if the submit button is clicked again within 500 milliseconds, the previous timer will be cleared and then reset with a delay of 500 milliseconds. The AJAX request will only be executed if the submit button is not clicked again within the delay time.

2. The principle and implementation of anti-duplicate submission
Anti-duplicate submission is a technology that ensures that each submission request is only executed once. Its principle is to record a mark after the first submission of the request. (such as a Token or a timestamp) and stores this token in the user's session. When the user submits the request again, first check whether this mark exists in the session. If it exists, it means that the request has been submitted, and the second submission is directly rejected; if it does not exist, it means that it is the first submission, perform the corresponding operation and record this Mark into the conversation.

In PHP, we can implement the anti-resubmission function through session storage and form field verification. First, add a unique identifier (can be a hidden field or a Token) to the form, and submit this unique identifier to the background each time a request is submitted. In the PHP program, first check whether this unique identifier exists in the session. If it exists, it means that the request has been submitted, and the second submission is directly rejected; if it does not exist, it means that it is the first submission, and the corresponding operation is performed and the request is submitted. A unique identifier is logged into the session.

The following is a specific sample code:

<?php
session_start();

// 校验表单字段
if ($_POST["token"] != $_SESSION["token"]) {
    die("重复提交请求！");
}

// 处理表单提交
// ...

// 记录唯一标识符到会话中
$_SESSION["token"] = uniqid();
?>

In this example, we first open the session through the session_start() function and verify the form fields Whether $_POST["token"] is equal to the identifier $_SESSION["token"] in the session. If they are not equal, it means that the request is submitted repeatedly, and the program ends directly and an error message is output; if they are equal, it means that the request is submitted for the first time, the corresponding operation is performed and the unique identifier uniqid() is recorded to the session middle.

Conclusion:
Anti-shaking and anti-repetitive submission provide a certain guarantee for the security of web forms. Through anti-shake and anti-repeated submission technical means, we can effectively avoid the problem of repeated form submission caused by user misoperation or network delay. However, anti-shaking and anti-duplicate submission can only solve some security problems and cannot completely guarantee the security of data. Therefore, in actual development, other security measures need to be combined to improve the security of Web forms, such as data verification, permission control, etc.

The above is the detailed content of Security analysis of anti-shaking and anti-duplicate submission in PHP. For more information, please follow other related articles on the PHP Chinese website!