Prevent direct access to action form

Question

I have a form.php wich action call sql.php file like:

SQL.PHP

if ($_REQUEST['action'] == "add") {
}
if ($_REQUEST['action'] == "edit") {
}

I'm like to prevent direct access, because user can call from browser url: http://sql.php?action=add One way is check if a submit. Seem work well.

if( isset($_POST['Submit']) && ($_POST['Submit'] == "Submit") )
{
echo "direct access not allowed";
}

There is better alternatives?

Hello Class, How to add a token, have you any reference or example? — user2307958, May 20 '13 at 03:04
@user2307958 this will give you a start but you might want to modify it to meet your needs [Cross-Site Request Forgeries](http://shiflett.org/articles/cross-site-request-forgeries) — Class, May 20 '13 at 03:07

score 0 · Answer 1 · 2013-05-20T03:06:00.110

Use the $_SERVER['HTTP_REFERER'] array to detect if someone is accessing your page directly by typing in it into the browser, or comming from another one of your pages, by a use of links from a page.

So, basically.

if($_SERVER['HTTP_REFERER'] == 'about.php'){
//let user do something
}

So, the $_SERVER['HTTP_REFERER'] global stores information of the pages you visit, and if you place echo that code, in your page, it will tell you from which page your are comming from. meaning, that if you only typed the page and access it, it will give 0/false value.

So, you can use it to detect if someone is directly typing the page or comming from one of your pages.

As others have indicated already, using tokens, and sessions would be a better idea since this method can be manipulated. So, I recommend you google them out

@j08691 I could recommend him sessions also, but for a newbee this would be a basic/good choise. but, I'll throw in a mention of sessions — , May 20 '13 at 03:01

score 0 · Answer 2 · answered May 20 '13 at 05:13

0

It should be if(!isset($_POST['Submit']) . Also if you use method="POST", it does not throw your parameters like ?action=add at the browser. method="GET" does it.

answered May 20 '13 at 05:13

Amir

4,089
4
16
28

Prevent direct access to action form

2 Answers2