Making a web page that can only be accessed by form submission

frshjb373

So I have a web form (Form A) that upon submitting, generates a price quote on the following page (Form 😎. Is there a way I can prohibit access to web page (Form 😎 to the general public unless they go through Form A first? Either through htaccess or php codes?

Any advice or resources are much appreciated!

bradgrafelman

One way might be to implement the use of a nonce value as described by traq here. In a nutshell, the general process would look like:

On Form A, generate a random value (e.g. via [man]uniqid/man) and store it in a [man]session[/man]. Additionally, output that same value in a hidden form field element (or add it in the query string of the form's action) such that it will be included in the user's request for Form B.
On Form B, check to see if both of the following are true:
1. A non-empty token/nonce value exists in the session.
2. The value passed from the form submission matches the value stored in the session
If so, [man]unset/man the stored session value and proceed with the submission of Form B as normal. Otherwise, reject the submission of Form B as invalid.

frshjb373

Thanks bradgrafelman. That makes sense. BTW...you linked me to my post. I had replied and and asked if you thought my code looked right, but you and your buddy ended up debating the headers in my code. If you think I should post it in the "code critique" instead, I can definitely do that as well. If you have some feedback, I would very much appreciate it. Again, thank you for all the help!