Geek asks and answers

Redirect / return in PHP

I have a site running in PHP and I have a page (say confirm.php)

And I just want to allow users who land on confirm.php from the page I specified (e.g. register.php), can I know if this can be achieved?

Regards, Andy.

+3
source share
5 answers

You cannot rely on HTTP REFERER because users can manipulate it and browsers may refuse to send it.

The only “safe” way would be to set the session variable to register.php and check if this variable is set to confirm.php. Something like that:

register.php:

session_start();
$_SESSION['valid_user'] = true;

confirm.php:

session_start();
if(!isset($_SESSION['valid_user'])) {
    die("You did not come from the page i specified!");
}

, register.php, register.php.

HTTP , . , , . ?

+8

HTTP - , .

- PHP, , .

register.php

<?php
session_start();

// some other code

$_SESSION['stateKey'] = sha1(time() . mt_rand()); // save a randomly created key

header('Location: confirm.php?key=' . $_SESSION['stateKey']);
?>

confirm.php

<?php
session_start();

if($_SESSION['stateKey'] == $_GET['key']){
    // pass, do things here
}

?>
+1

: $_SERVER['HTTP_REFERER'] header ...

0

$_SERVER ['HTTP_REFERREF'] script, script

0

$_SERVER['HTTP_REFERER']

Additional information: here

0
source

More articles:


All Articles