防止php重复提交表单更安全的方法

Token.php  

<?php  

/*

 * Created on 2013-3-25

 *

 * To change the template for this generated file go to

 * Window - Preferences - PHPeclipse - PHP - Code Templates

 */

function getToken($len = 32, $md5 = true) {

    # Seed random number generator

    # Only needed for PHP versions prior to 4.2

    mt_srand((double) microtime() * 1000000);

    # Array of characters, adjust as desired

    $chars = array (

        'Q',

        '@',

        '8',

        'y',

        '%',

        '^',

        '5',

        'Z',

        '(',

        'G',

        '_',

        'O',

        '`',

        'S',

        '-',

        'N',

        '<',

        'D',

        '{',

        '}',

        '[',

        ']',

        'h',

        ';',

        'W',

        '.',

        '/',

        '|',

        ':',

        '1',

        'E',

        'L',

        '4',

        '&',

        '6',

        '7',

        '#',

        '9',

        'a',

        'A',

        'b',

        'B',

        '~',

        'C',

        'd',

        '>',

        'e',

        '2',

        'f',

        'P',

        'g',

        ')',

        '?',

        'H',

        'i',

        'X',

        'U',

        'J',

        'k',

        'r',

        'l',

        '3',

        't',

        'M',

        'n',

        '=',

        'o',

        '+',

        'p',

        'F',

        'q',

        '!',

        'K',

        'R',

        's',

        'c',

        'm',

        'T',

        'v',

        'j',

        'u',

        'V',

        'w',

        ',',

        'x',

        'I',

        '$',

        'Y',

        'z',

        '*'

    );

    # Array indice friendly number of chars;

    $numChars = count($chars) - 1;

    $token = '';

    # Create random token at the specified length

    for ($i = 0; $i < $len; $i++)

        $token .= $chars[mt_rand(0, $numChars)];

    # Should token be run through md5?

    if ($md5) {

        # Number of 32 char chunks

        $chunks = ceil(strlen($token) / 32);

        $md5token = '';

        # Run each chunk through md5

        for ($i = 1; $i <= $chunks; $i++)

            $md5token .= md5(substr($token, $i * 32 - 32, 32));

        # Trim the token

        $token = substr($md5token, 0, $len);

    }

    return $token;

}

?>

form.php  

<?php

include_once("token.php");

$token = getToken();

session_start();

$_SESSION['token'] = $token;

?>

<form action="action.php" method="post"

<input type="hidden" name="token" value="<?=$token?>" />

<!-- 其他input submit之类的 -->

</form>

action.php  

<?php

session_start();

if($_POST['token'] == $_SESSION['token']){

    unset($_SESSION['token']);

    echo "这是一个正常的提交请求";

}else{

    echo "这是一个非法的提交请求";

}

?>
巴特西

防止php重复提交表单更安全的方法

最新文章

热门文章
