Home php教程 php手册 PHP令牌 Token改进版

PHP令牌 Token改进版

Jun 13, 2016 pm 12:28 PM
base64 get php token token Bundle Improve method Version this pass

正是由于使用了 base64 ,所以在把这个令牌通过 GET方法发送的时候,出现了问题。
比如:http://test/test.php?a=1+2
你用 $_GET["a"] 取得是:1 2 ,即那个加号没有了。一开始我用 urlencode 对其进行转换,但是总有那么一两的结果是意料外的。

后来想想 base64 的字符就限定于: [A-Za-z0-9\+\/=] 这么多,加号出问题,我就把加号换成不出问题的符号,下划线是最好的选择。下面是修改后的代码:

GEncrypt.inc.php

复制代码 代码如下:


class GEncrypt { 
 protected static function keyED($txt, $encrypt_key) { 
  $encrypt_key = md5 ( $encrypt_key ); 
  $ctr = 0; 
  $tmp = ""; 
  for($i = 0; $i    if ($ctr == strlen ( $encrypt_key )) 
    $ctr = 0; 
   $tmp .= substr ( $txt, $i, 1 ) ^ substr ( $encrypt_key, $ctr, 1 ); 
   $ctr ++; 
  } 
  return $tmp; 
 } 

 public static function encrypt($txt, $key) { 
  $encrypt_key = md5 ( (( float ) date ( "YmdHis" ) + rand ( 10000000000000000, 99999999999999999 )) . rand ( 100000, 999999 ) ); 
  $ctr = 0; 
  $tmp = ""; 
  for($i = 0; $i    if ($ctr == strlen ( $encrypt_key )) 
    $ctr = 0; 
   $tmp .= substr ( $encrypt_key, $ctr, 1 ) . (substr ( $txt, $i, 1 ) ^ substr ( $encrypt_key, $ctr, 1 )); 
   $ctr ++; 
  } 
  return ( preg_replace("/\\+/s","_", base64_encode ( self::keyED ( $tmp, $key ) ) )); 
 } 
 //base64 [A-Za-z0-9\+\/=] 
 public static function decrypt($txt, $key) { 
  if($txt == ""){ return false;}  
  //echo preg_replace("/_/s","+",$txt); 
  $txt = self::keyED (base64_decode ( preg_replace("/_/s","+", $txt) ), $key ); 
  $tmp = ""; 
  for($i = 0; $i    $md5 = substr ( $txt, $i, 1 ); 
   $i ++; 
   $tmp .= (substr ( $txt, $i, 1 ) ^ $md5); 
  } 
  return $tmp; 
 } 


?> 


GToken.inc.php

复制代码 代码如下:


/** 
 * 原理:请求分配token的时候,想办法分配一个唯一的token, base64( time + rand + action) 
 * 如果提交,将这个token记录,说明这个token以经使用,可以跟据它来避免重复提交。 
 * 
 */ 
class GToken { 

 /** 
  * 得到当前所有的token 
  * 
  * @return array 
  */ 
 public static function getTokens(){ 
  $tokens = $_SESSION[GConfig::SSN_KEY_TOKEN ]; 
  if (empty($tokens) && !is_array($tokens)) { 
   $tokens = array(); 
  } 
  return $tokens; 
 } 

 /** 
  * 产生一个新的Token 
  * 
  * @param string $formName 
  * @param 加密密钥 $key 
  * @return string 
  */ 

 public static function newToken($formName,$key = GConfig::ENCRYPT_KEY ){ 
  $token = GEncrypt::encrypt($formName.session_id(),$key); 
  return $token; 
 } 

 /** 
  * 删除token,实际是向session 的一个数组里加入一个元素,说明这个token以经使用过,以避免数据重复提交。 
  * 
  * @param string $token 
  */ 
 public static function dropToken($token){ 
  $tokens = self::getTokens(); 
  $tokens[] = $token; 
  GSession::set(GConfig::SESSION_KEY_TOKEN ,$tokens); 
 } 

 /** 
  * 检查是否为指定的Token 
  * 
  * @param string $token 要检查的token值 
  * @param string $formName  
  * @param boolean $fromCheck 是否检查来路,如果为true,会判断token中附加的session_id是否和当前session_id一至. 
  * @param string $key 加密密钥 
  * @return boolean 
  */ 

 public static function isToken($token,$formName,$fromCheck = false,$key = GConfig::ENCRYPT_KEY){ 
  if(empty($token)) return false; 

  $tokens = self::getTokens(); 

  if (in_array($token,$tokens)) //如果存在,说明是以使用过的token 
   return false; 

  $source = GEncrypt::decrypt($token,$key); 

  if($fromCheck) 
   return $source == $formName.session_id(); 
  else{ 
   return strpos($source,$formName) === 0; 
  } 
 } 

 public static function getTokenKey($token,$key = GConfig::ENCRYPT_KEY){ 
  if($token == null || trim($token) == "") return false; 
  $source = GEncrypt::decrypt($token,$key); 
  return $source != "" ? str_replace(session_id(),"",$source) : false; 
 } 

 public function newTokenForSmarty($params){ 
  $form = null; 
  extract($params); 
  return self::newToken($form); 
 } 

?> 

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

AI Hentai Generator

AI Hentai Generator

Generate AI Hentai for free.

Hot Article

R.E.P.O. Energy Crystals Explained and What They Do (Yellow Crystal)
2 weeks ago By 尊渡假赌尊渡假赌尊渡假赌
Repo: How To Revive Teammates
1 months ago By 尊渡假赌尊渡假赌尊渡假赌
Hello Kitty Island Adventure: How To Get Giant Seeds
4 weeks ago By 尊渡假赌尊渡假赌尊渡假赌

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

CakePHP Project Configuration CakePHP Project Configuration Sep 10, 2024 pm 05:25 PM

In this chapter, we will understand the Environment Variables, General Configuration, Database Configuration and Email Configuration in CakePHP.

PHP 8.4 Installation and Upgrade guide for Ubuntu and Debian PHP 8.4 Installation and Upgrade guide for Ubuntu and Debian Dec 24, 2024 pm 04:42 PM

PHP 8.4 brings several new features, security improvements, and performance improvements with healthy amounts of feature deprecations and removals. This guide explains how to install PHP 8.4 or upgrade to PHP 8.4 on Ubuntu, Debian, or their derivati

CakePHP Date and Time CakePHP Date and Time Sep 10, 2024 pm 05:27 PM

To work with date and time in cakephp4, we are going to make use of the available FrozenTime class.

CakePHP File upload CakePHP File upload Sep 10, 2024 pm 05:27 PM

To work on file upload we are going to use the form helper. Here, is an example for file upload.

CakePHP Routing CakePHP Routing Sep 10, 2024 pm 05:25 PM

In this chapter, we are going to learn the following topics related to routing ?

Discuss CakePHP Discuss CakePHP Sep 10, 2024 pm 05:28 PM

CakePHP is an open-source framework for PHP. It is intended to make developing, deploying and maintaining applications much easier. CakePHP is based on a MVC-like architecture that is both powerful and easy to grasp. Models, Views, and Controllers gu

How To Set Up Visual Studio Code (VS Code) for PHP Development How To Set Up Visual Studio Code (VS Code) for PHP Development Dec 20, 2024 am 11:31 AM

Visual Studio Code, also known as VS Code, is a free source code editor — or integrated development environment (IDE) — available for all major operating systems. With a large collection of extensions for many programming languages, VS Code can be c

CakePHP Creating Validators CakePHP Creating Validators Sep 10, 2024 pm 05:26 PM

Validator can be created by adding the following two lines in the controller.

See all articles