A somewhat restricting code...

Avimander

I want to make a code, that when you edit the $GET variables, or try to access the site for any matter (on "main.php"), it will lead you to a specific spot in the page, the one where "main.php" has no $GET variables. The problem is, is I don't know where to start.

I want to know this because (yes, I know there are other ways to get around this, but its a basic security measure)...

I'll explain it in detail: I have an image. I made a program (outside of PHP) that generated 250 <area> tags for the image. One of those is the special one, and if you go to lets say... "main.php?Click=233", then the special thing happens. I don't want people cheating for this. I know people could just tlel other people where it is, but whatever. I want them to have to click on the image so that happens, I dont want people typing that in, after someone finds out. And for some other parts of my site also. So when MY SITE doesn't redirect them to MY SITE again, it goes to the main page.

Can anyone understand/help? Please?

sarahk

I'd say you want the click to be a form event, not a hyperlink with a get type variable.

Avimander

Thanks, I'm going to do that. But, for now, lets ignore that, and say I wanted to pass SOME variables with get. How would I prevent them from being altered by changing the text in the address bar?

sarahk

You can't, that's the point of the POST suggestion.

The best you can do is to hold the restricted part in an iframe or normal frame and have javascript check that the frame is loaded. That way the user sees the address of the top page and not the image page. When if submits it submits back to it's frame with the address hidden.

However, I can still click "open in new window" and break out. If I do that you need some javascript to come up quickly and change the location to something benign but only after you have saved the variables in a session so you don't lose them. Phew, that's alot of work.

Avimander

I was thinking of two things:

A "Only use one window" code, and a "When you do something set by me, the next page acknowledges it without GET variables"

But I need the first one either way.
The second I could just change to all POST vars.

sarahk

can I see your work in progress to get a better understanding, either post your code or direct me to your site.