Home Backend Development PHP Tutorial PHP prevents CC attack code PHP prevents frequent refresh of web pages

PHP prevents CC attack code PHP prevents frequent refresh of web pages

Jun 02, 2018 pm 02:11 PM
php code Web page

This article mainly introduces the code of PHP to prevent CC attacks and PHP to prevent frequent refresh of web pages, rapid and malicious refresh of web pages. CC attacks use proxy servers to generate legitimate requests directed to the target site, simulating multiple users to continuously access the victim website. , interested friends can study

Rapid malicious refresh of web pages, cc attack is that the attacker uses the proxy server to generate legitimate requests directed to the target site, simulating multiple users to continuously access the victim website, especially Accessing pages that require a large amount of data operations and a large amount of CPU time will eventually lead to the target website server resources being exhausted until it crashes. In this way, server resources are wasted, and the CPU is at 100% for a long time, and there is always processing. Endless connections occur until the network is congested and normal access is terminated. We call it a CC attack. Although we can use some anti-attack software to achieve this, the effect is sometimes not obvious.

Below I provide a piece of PHP code that can prevent CC attacks to a certain extent.
Main functions: Continuously refreshing the page more than 5 times within 3 seconds will point to the local http://127.0.0.1
Just put this code on the page that needs to prevent CC attacks. Can.
Source code

<?php
$timestampcc = time();
$cc_nowtime = $timestampcc;
if(session_is_registered(&#39;cc_lasttime&#39;)){
 $cc_lasttime = $_SESSION[&#39;cc_lasttime&#39;];
 $cc_times = $_SESSION[&#39;cc_times&#39;]+1;
 $_SESSION[&#39;cc_times&#39;] = $cc_times;
}else{
 $cc_lasttime = $cc_nowtime;
 $cc_times = 1;
 $_SESSION[&#39;cc_times&#39;] = $cc_times;
 $_SESSION[&#39;cc_lasttime&#39;] = $cc_lasttime;
} 
if(($cc_nowtime-$cc_lasttime)<3){//3秒内刷新5次以上可能为cc攻击
 if($cc_times>=5){
 echo &#39;刷新太快!&#39;;
 exit;
 }
}else{
 $cc_times = 0;
 $_SESSION[&#39;cc_lasttime&#39;] = $cc_nowtime;
 $_SESSION[&#39;cc_times&#39;] = $cc_times;
} 
?>
Copy after login

The following is an effective method for preventing CC attacks in PHP for everyone:

1 .session record
submit.php is the sending page. Set a session variable on this page and send it to the submitdeal.php page as a hidden field and form. On the server side, the hidden variable posted from the post is sent to the server. Compare the session variables recorded on the end. For example, if they are the same, write to the database and clear the session. In this way, when the user refreshes the page, if the two values ​​are not equal, an error or jump will be prompted.
Advantages: No need for users to enter verification codes
Disadvantages: The form is easily copied
2 .Verification code
The principle is the same as the first one, except that the session data is not submitted as a hidden field, but is filled in by the user. Most websites use text verification codes and picture verification codes, and picture verification codes are highly secure. .

3.IP binding
After submitting the data, first retrieve the client IP from the IP table. If there is one and it has not expired, then an error will be reported, otherwise it will be written to the database, and then Then get the guest room IP and write the IP into the database.
4.cookie:After the client submits, the processing program first searches whether the client has set a cookie. If so, it will not submit again; if not, it will write the data and then write a cookie;
Example:

Users' meaningless frequent jumps and requests will put a lot of burden on the server. In fact, using cookies can prevent this.

<?php 
error_reporting(0); 
//if($_COOKIE["ck"])die("刷新过快!"); 
if($_COOKIE["ck"])header("Location:http://www.baidu.com");//这里如果用户刷新过快,给予终止php脚本或者直接302跳转 
setcookie("ck","1",time()+3);//设定cookie存活时间3s 
echo "hello!"; 
?>
Copy after login

Method one:

<?php  
session_start();  
$k=$_GET[&#39;k&#39;];  
$t=$_GET[&#39;t&#39;];  
$allowTime = 1800;//防刷新时间  
$ip = get_client_ip();  
$allowT = md5($ip.$k.$t);  
if(!isset($_SESSION[$allowT]))  
{  
 $refresh = true;  
 $_SESSION[$allowT] = time();  
}elseif(time() - $_SESSION[$allowT]>$allowTime){  
 $refresh = true;  
 $_SESSION[$allowT] = time();  
}else{  
 $refresh = false;  
}  
?>
Copy after login

Method two:

<? 
session_start(); 
if(!emptyempty($_POST[name])){ 
 $data = $_POST[name]; 
 $tag = $_POST[tag]; 
 if($_SESSION[status]==$tag){ 
 echo $data; 
 }else{ 
 echo "不允许刷新!"; 
 } 
} 
$v = mt_rand(1,10000); 
?> 
<form method="post" name="magic" action="f5.php"><input type="hidden" 
name="tag" value="<?=$v?>"><input type=text name="name"><input type="submit" value="submit"> 
</form> 
<? 
echo $v; 
$_SESSION[status] = $v; 
?>
Copy after login
Copy after login

Method three:

<? 
session_start(); 
if(!emptyempty($_POST[name])){ 
 $data = $_POST[name]; 
 $tag = $_POST[tag]; 
 if($_SESSION[status]==$tag){ 
 echo $data; 
 }else{ 
 echo "不允许刷新!"; 
 } 
} 
$v = mt_rand(1,10000); 
?> 
<form method="post" name="magic" action="f5.php"><input type="hidden" 
name="tag" value="<?=$v?>"><input type=text name="name"><input type="submit" value="submit"> 
</form> 
<? 
echo $v; 
$_SESSION[status] = $v; 
?>
Copy after login
Copy after login

The above is php There are many ways to prevent CC attacks. I hope it can help everyone prevent web pages from being refreshed quickly and maliciously.

Related recommendations:

ThinkPHP’s method to prevent repeated submission of forms

Explanation of PHP’s method to prevent sql injection

The above is the detailed content of PHP prevents CC attack code PHP prevents frequent refresh of web pages. For more information, please follow other related articles on the PHP Chinese website!

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

AI Hentai Generator

AI Hentai Generator

Generate AI Hentai for free.

Hot Article

R.E.P.O. Energy Crystals Explained and What They Do (Yellow Crystal)
2 weeks ago By 尊渡假赌尊渡假赌尊渡假赌
Repo: How To Revive Teammates
4 weeks ago By 尊渡假赌尊渡假赌尊渡假赌
Hello Kitty Island Adventure: How To Get Giant Seeds
3 weeks ago By 尊渡假赌尊渡假赌尊渡假赌

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

CakePHP Project Configuration CakePHP Project Configuration Sep 10, 2024 pm 05:25 PM

In this chapter, we will understand the Environment Variables, General Configuration, Database Configuration and Email Configuration in CakePHP.

PHP 8.4 Installation and Upgrade guide for Ubuntu and Debian PHP 8.4 Installation and Upgrade guide for Ubuntu and Debian Dec 24, 2024 pm 04:42 PM

PHP 8.4 brings several new features, security improvements, and performance improvements with healthy amounts of feature deprecations and removals. This guide explains how to install PHP 8.4 or upgrade to PHP 8.4 on Ubuntu, Debian, or their derivati

CakePHP Date and Time CakePHP Date and Time Sep 10, 2024 pm 05:27 PM

To work with date and time in cakephp4, we are going to make use of the available FrozenTime class.

CakePHP File upload CakePHP File upload Sep 10, 2024 pm 05:27 PM

To work on file upload we are going to use the form helper. Here, is an example for file upload.

CakePHP Routing CakePHP Routing Sep 10, 2024 pm 05:25 PM

In this chapter, we are going to learn the following topics related to routing ?

Discuss CakePHP Discuss CakePHP Sep 10, 2024 pm 05:28 PM

CakePHP is an open-source framework for PHP. It is intended to make developing, deploying and maintaining applications much easier. CakePHP is based on a MVC-like architecture that is both powerful and easy to grasp. Models, Views, and Controllers gu

How To Set Up Visual Studio Code (VS Code) for PHP Development How To Set Up Visual Studio Code (VS Code) for PHP Development Dec 20, 2024 am 11:31 AM

Visual Studio Code, also known as VS Code, is a free source code editor — or integrated development environment (IDE) — available for all major operating systems. With a large collection of extensions for many programming languages, VS Code can be c

CakePHP Creating Validators CakePHP Creating Validators Sep 10, 2024 pm 05:26 PM

Validator can be created by adding the following two lines in the controller.

See all articles