Checking form submit page

[Corpheous]

I just figured out that Joe Schmoe can make a page and use it to submit variables to my pages on my site. I need to figure out how to make sure the form variables are being submitted from MY page as opposed to someone elses.

Any help?

[lazzerous]

you can do this with javascript
something like:

<script language="JavaScript">
if (history.go(-1) != "mysite.com/form.php")
    {
    alert ("you didnt post this from my site!");
    }
</script>

This isn't valid code, but you should get the idea...

-=Lazzerous=-

[Corpheous]

Hmm, that's alright but if someone disables javascript they go right through. I heard there's some PHP code that I can use but I have no clue what it is. Anyone know another way?

[lazzerous]

$_SERVER[HTTP-REFERER]

but it cant always be trusted...

-=Lazz=-

[Corpheous]

Ok, thats seems to work quite well, but just so I don't immediately run into another hacker problem, why shouldn't it always be trusted?

[TomD]

Originally posted by Corpheous
Hmm, that's alright but if someone disables javascript they go right through. I heard there's some PHP code that I can use but I have no clue what it is. Anyone know another way?

Start a session and pass the session ID as a hidden field. Test this passed value against the session ID that gets the form data and they should be the same.