Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>If you want to discourage some casual user from posting from someone else's site to yours, you might be able to check <code>$_SERVER['HTTP_REFERER']</code>. The browser sends a "referer" along with most requests, which in many cases is the page that the user clicked to get there. It's definitely not foolproof, though -- a browser (or a bot) can fudge it at will, and some browsers (or plugins for such browsers) will do so on purpose. The users of those browsers are generally pretty big on privacy, and you're not that special. They'll probably prefer going elsewhere rather than disabling their privacy stuff for you.</p> <p>You could require a session variable set in order to post, but that's rather trivial to get around too. <code>&lt;img src="http://your.site/yourForm.php" width="1" height="1"&gt;</code> would be enough to get a session variable set.</p> <p>A hidden form field sounds doable, but i could write a script to fetch your form, grab the hidden field, and insert it into my form. It'd only be useful in conjunction with a session variable that says what ID to expect...and that gets really wacky if people use the Back button in certain ways. It'd also fail if i proxy the request (ie: the user talks to my server, which requests a form from you (and gets a session ID), and then when the user posts to my site, i post to yours using the session ID and hidden values that you sent me). About the only way around that is HTTPS, and even that's useless if the user is expecting the form to come from me and not you.</p> <p>Basically, there's no way short of a combination of the above stuff plus a decent CAPTCHA to <em>prevent</em> other sites from posting to your form. And even that has its weaknesses. The best you can do is make it a pain...and that'll make it a pain for some percentage of your users as well. Your best bet is to make sure the script that accepts the post verifies its contents, and not care where the request came from.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload