Cheking referrer of a POST to PHP Script

intercampus

Hi, i have the following post box on my website and i was wondering how could i stop somebody from saving the html on their machine and then proceed to change it to allow themselves more characters on the post and submit the message to my website... may be is i could check the referrer and only letting trough the posts from my domain, how can i add this to my script?

<form method="post" action="prepa7.php">
<div align="center"><center><table border=0 width=430 cellpadding=0 cellspacing=0><tr>
<td width="100%"><div align="center"><center><table border=0 width=430 cellpadding=0 cellspacing=0>
<tr>
<td width="100"><font face="Comic Sans MS,Arial,Helvetica" color="#DF6020">Nombre:</font></td>
<td width="330"><input type="text" size="20" name="name"></td>
</tr>
<tr>
<td width="100" valign="top"><font face="Comic Sans MS,Arial,Helvetica" color="#DF6020">Chisme<br>Saludo:</font></td>
<td width="330"><input type="text" size="40" name="message"></td></tr><tr>
<td width="100" valign="top"><font face="Comic Sans MS,Arial,Helvetica" size = "2" color="#DF6020">Icono:</font></td>
<td width="330"><font face="Comic Sans MS,Arial,Helvetica" size="2"><input type="radio" value="none" name="icons" checked>none</font> <input type="radio" value="cry.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/cry.gif"><input type="radio" value="goldstar.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/goldstar.gif">
<input type="radio" value="maestro.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/maestro.gif"><input type="radio" value="porel.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/porel.gif"><input type="radio" value="woman.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/woman.gif"><input type="radio" value="hotdog.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/hotdog.gif"><br>
<input type="radio" value="female.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/female.gif"><input type="radio" value="male.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/male.gif">
<input type="radio" value="ladybug.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/ladybug.gif">
<input type="radio" value="lentes.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/lentes.gif">

<input type="radio" value="bill.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/bill.gif"><input type="radio" value="miedo.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/miedo.gif">
<input type="radio" value="shoes.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/shoes.gif"><input type="radio" value="beer.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/beer.gif"><br><input type="radio" value="cheese.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/cheese.gif">
<input type="radio" value="apple.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/apple.gif"><input type="radio" value="leyendo.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/leyendo.gif">
<input type="radio" value="sun.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/sun.gif"><input type="radio" value="clover.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/clover.gif"><input type="radio" value="kiss.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/kiss.gif"><input type="radio" value="faje.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/faje.gif"><br>
<input type="radio" value="beer2.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/beer2.gif"><input type="radio" value="besin.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/besin.gif"><input type="radio" value="flores.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/flores.gif"><input type="radio" value="duh.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/duh.gif"><input type="radio" value="iluvu.gif" name="icons"><img src="http://66.154.5.54/intercampus/img/chismes/iluvu.gif"></td></tr><tr>
<td width="120"></td>
<td width="330"><input type="submit" name="form_action" value="Post">  <input type="reset" value="Clear"></td>
</tr><tr>
<td width="430" colspan="2"> <table border="0" cellpadding="3" cellspacing="0" width="100%"><tr>
<td width="40%" bgcolor="#C0C0C0"><div align="center"><center><p><font face="Comic Sans MS,Arial,Helvetica" color="#000000"><small>PON TU COMENTARIO Y PRESIONA EL BOTON POST</small></font>

cgraz

Just check the string length on the processing page. For example, name can't be more than 20 characters long.


if(strlen($_POST['name']) > 20) {
   echo "Too long!";
} else {
   echo "Name length is ok";
}

etc

And if you do want to do something with the referrer, then the way to get that is $_SERVER['HTTP_REFERER']

Cgraz

intercampus

Thanks, this works fine to avoid the flooding, but, this still allows the "cracker" to post other images, so i guess the referrer check is going to work better but i dont know php, can someone please put a little piece of code that i could add to check if it comes from my server the post? if not, just put a message on the screen, thanks a lot !!

cgraz

what do you mean post images? No one can modify your html and change your web site.

I thought your original concern was someone creating a form, saving it to their computer, and setting the action to your page, but you do understand that unless someone has access to your ftp server, they can't actually change anything on your site. I can't just go to your site, change your code, and when I save it it changes your site. The best I could do is save it to my desktop, but that has absolutely NO effect on your site (which is on YOUR web server). If this was possible, everyone's sites would be vandalized.

Cgraz

intercampus

As you can see on the code, in the form you can define the image that is going to be on the post, if you save the file on your desktop and change that, the code is going to display that image, and noup, my server is well secured except for this little problem i have with this user.

The referrer thing i bet is going to work...

cgraz

if($_SERVER['HTTP_REFERER'] != 'http://www.yourdomain.com/form_script_name.php') {
   echo "You didn't come from my site!";
   exit;
}

// process the results down here.

Cgraz