


PHP prevents CC attack code PHP prevents frequent refresh of web pages
This article mainly introduces the code of PHP to prevent CC attacks and PHP to prevent frequent refresh of web pages, rapid and malicious refresh of web pages. CC attacks use proxy servers to generate legitimate requests directed to the target site, simulating multiple users to continuously access the victim website. , interested friends can study
Rapid malicious refresh of web pages, cc attack is that the attacker uses the proxy server to generate legitimate requests directed to the target site, simulating multiple users to continuously access the victim website, especially Accessing pages that require a large amount of data operations and a large amount of CPU time will eventually lead to the target website server resources being exhausted until it crashes. In this way, server resources are wasted, and the CPU is at 100% for a long time, and there is always processing. Endless connections occur until the network is congested and normal access is terminated. We call it a CC attack. Although we can use some anti-attack software to achieve this, the effect is sometimes not obvious.
Below I provide a piece of PHP code that can prevent CC attacks to a certain extent.
Main functions: Continuously refreshing the page more than 5 times within 3 seconds will point to the local http://127.0.0.1
Just put this code on the page that needs to prevent CC attacks. Can.
Source code
<?php $timestampcc = time(); $cc_nowtime = $timestampcc; if(session_is_registered('cc_lasttime')){ $cc_lasttime = $_SESSION['cc_lasttime']; $cc_times = $_SESSION['cc_times']+1; $_SESSION['cc_times'] = $cc_times; }else{ $cc_lasttime = $cc_nowtime; $cc_times = 1; $_SESSION['cc_times'] = $cc_times; $_SESSION['cc_lasttime'] = $cc_lasttime; } if(($cc_nowtime-$cc_lasttime)<3){//3秒内刷新5次以上可能为cc攻击 if($cc_times>=5){ echo '刷新太快!'; exit; } }else{ $cc_times = 0; $_SESSION['cc_lasttime'] = $cc_nowtime; $_SESSION['cc_times'] = $cc_times; } ?>
The following is an effective method for preventing CC attacks in PHP for everyone:
1 .session record
submit.php is the sending page. Set a session variable on this page and send it to the submitdeal.php page as a hidden field and form. On the server side, the hidden variable posted from the post is sent to the server. Compare the session variables recorded on the end. For example, if they are the same, write to the database and clear the session. In this way, when the user refreshes the page, if the two values are not equal, an error or jump will be prompted.
Advantages: No need for users to enter verification codes
Disadvantages: The form is easily copied
2 .Verification code
The principle is the same as the first one, except that the session data is not submitted as a hidden field, but is filled in by the user. Most websites use text verification codes and picture verification codes, and picture verification codes are highly secure. .
3.IP binding
After submitting the data, first retrieve the client IP from the IP table. If there is one and it has not expired, then an error will be reported, otherwise it will be written to the database, and then Then get the guest room IP and write the IP into the database.
4.cookie:After the client submits, the processing program first searches whether the client has set a cookie. If so, it will not submit again; if not, it will write the data and then write a cookie;
Example:
Users' meaningless frequent jumps and requests will put a lot of burden on the server. In fact, using cookies can prevent this.
<?php error_reporting(0); //if($_COOKIE["ck"])die("刷新过快!"); if($_COOKIE["ck"])header("Location:http://www.baidu.com");//这里如果用户刷新过快,给予终止php脚本或者直接302跳转 setcookie("ck","1",time()+3);//设定cookie存活时间3s echo "hello!"; ?>
Method one:
<?php session_start(); $k=$_GET['k']; $t=$_GET['t']; $allowTime = 1800;//防刷新时间 $ip = get_client_ip(); $allowT = md5($ip.$k.$t); if(!isset($_SESSION[$allowT])) { $refresh = true; $_SESSION[$allowT] = time(); }elseif(time() - $_SESSION[$allowT]>$allowTime){ $refresh = true; $_SESSION[$allowT] = time(); }else{ $refresh = false; } ?>
Method two:
<? session_start(); if(!emptyempty($_POST[name])){ $data = $_POST[name]; $tag = $_POST[tag]; if($_SESSION[status]==$tag){ echo $data; }else{ echo "不允许刷新!"; } } $v = mt_rand(1,10000); ?> <form method="post" name="magic" action="f5.php"><input type="hidden" name="tag" value="<?=$v?>"><input type=text name="name"><input type="submit" value="submit"> </form> <? echo $v; $_SESSION[status] = $v; ?>
Method three:
<? session_start(); if(!emptyempty($_POST[name])){ $data = $_POST[name]; $tag = $_POST[tag]; if($_SESSION[status]==$tag){ echo $data; }else{ echo "不允许刷新!"; } } $v = mt_rand(1,10000); ?> <form method="post" name="magic" action="f5.php"><input type="hidden" name="tag" value="<?=$v?>"><input type=text name="name"><input type="submit" value="submit"> </form> <? echo $v; $_SESSION[status] = $v; ?>
The above is php There are many ways to prevent CC attacks. I hope it can help everyone prevent web pages from being refreshed quickly and maliciously.
Related recommendations:
ThinkPHP’s method to prevent repeated submission of forms
Explanation of PHP’s method to prevent sql injection
The above is the detailed content of PHP prevents CC attack code PHP prevents frequent refresh of web pages. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

AI Hentai Generator
Generate AI Hentai for free.

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

In this chapter, we will understand the Environment Variables, General Configuration, Database Configuration and Email Configuration in CakePHP.

PHP 8.4 brings several new features, security improvements, and performance improvements with healthy amounts of feature deprecations and removals. This guide explains how to install PHP 8.4 or upgrade to PHP 8.4 on Ubuntu, Debian, or their derivati

To work with date and time in cakephp4, we are going to make use of the available FrozenTime class.

To work on file upload we are going to use the form helper. Here, is an example for file upload.

In this chapter, we are going to learn the following topics related to routing ?

CakePHP is an open-source framework for PHP. It is intended to make developing, deploying and maintaining applications much easier. CakePHP is based on a MVC-like architecture that is both powerful and easy to grasp. Models, Views, and Controllers gu

Visual Studio Code, also known as VS Code, is a free source code editor — or integrated development environment (IDE) — available for all major operating systems. With a large collection of extensions for many programming languages, VS Code can be c

Validator can be created by adding the following two lines in the controller.
