How about registering a session variable on the initial form page. There is no way to fake a session id from another domain unless you specifically allow this.
Since sessions all go on behind the scenes (server side), there will be no evidence of this to the possible attacker.
<!-- index.php -->
<?php
session_start();
if (!isset($submit)){ //Display Form
echo "<form action=index.php>";
echo "<input type=text name=textbox1>";
echo "<input type=hidden name=submit value=submit>";
echo "<input type=submit value='GO'>";
echo "</form>";
$session_ok="VALID";
session_register("session_ok");
}
else { //Act on form submission
if (session_is_registered("session_ok"){
//Do you stuff because the session is registered
}
else {
// I would log and redirect the individual
}
}
<!-- End index.php -->
This is pretty rough but I think it will work. I'm sure there may be another way to do this. There always is. I'm sure if this is totally wrong someone will let me know. 🙂
