How to use PHP to obtain referer and determine the source to prevent illegal access

This article will introduce to you how to use PHP to obtain the referer to determine the source to prevent illegal access? It has certain reference value. Friends in need can refer to it. I hope it will be helpful to everyone.

The php code of download page down.php Now I found that if I open it directly with Thunder or Google Chrome, the downloaded file can be output, and it has no anti-leeching effect at all. Now I want to allow only those connected to my own site to use it directly. Those connected to other sites and those who directly enter this address will jump to the copy.htm page.

The $_SERVER["HTTP_REFERER"] predefined server variable in PHP can determine the source.

$_SESSION['HTTP_REFERER'] can obtain the source address of the previous connection of the current link, that is, the URL address of the previous page linked to the current page.
It is generally used to determine where the viewer clicked the link to jump to this page, that is, the so-called origin. It can also be used to prevent hotlinking by determining the origin.
For example:

<?php
 $url_array = parse_url($_SESSION[&#39;HTTP_REFERER&#39;]); 
 //如果页面的域名不是服务器域名,就连接到登陆窗口 
 if($_SERVER[&#39;HTTP_HOST&#39;] != $url_array["host"]) { 
 header("location: login.php"); 
 exit; 
 } 
 ?>

Recently there is a project that needs to prevent users from illegally accessing a json page. The basic solution is to determine the source to restrict non-call access:

$_SERVER[‘HTTP_REFERER’]：来路链接，可能带尾巴（如： 
可以通过php内置函数parse_url()来获取到当前网址（www.httple.net），即：
$refererUrl = parse_url($_SERVER[‘HTTP_REFERER’]);
$host = $refererUrl[‘host’];
$host的值即为来路的网址(www.httple.net)。
获取到了来路的网址之后，我们就可以通过这个网址来限制访问该页面的权限了。代码如下：
if(!isset($_SERVER[‘HTTP_REFERER’]) || $referurl[‘host’] !=”www.httple.net”) { header(“location: /”); 
//如果没有来路，或者来路不是本站，跳转到首页。 exit; }

Putting this line of code at the top of the json data page can easily solve this problem.

Defects of this processing method: the normal data of the page can be obtained through forged sources.

Related code

The method of getting the source Url mainly uses the HTTP_REFERER function in the server variable. The code is pasted:

function get_referer(){   
$url = $_SERVER["HTTP_REFERER"]; //获取完整的来路URL   
$str = str_replace("http://","",$url); //去掉http://   
$strdomain = explode("/",$str); // 以“/”分开成数组   
$domain = $strdomain[0]; //取第一个“/”以前的字符  
return $domain;  
}   

//对于百度、谷歌搜索引擎来路判断   
function get_seo(){  
$s = 0;   
if(strstr(get_referer(),'baidu.com')){   
$s = 1;   
}   
else if(strstr(get_referer(),'google.com.hk')){   
$s = 1;   
}   
return $se;    
}

php website Get the source Url The method mainly uses the HTTP_REFERER function in the server variable. The code is pasted:

function get_referer(){
$url = $_SERVER["HTTP_REFERER"]; //获取完整的来路URL
$str = str_replace(“http://”,””,$url); //去掉http://
$strdomain = explode(“/”,$str); // 以“/”分开成数组
$domain = $strdomain[0]; //取第一个“/”以前的字符
return $domain;
}

//对于百度、谷歌搜索引擎来路判断
function get_seo(){
$s = 0;
if(strstr(get_referer(),’baidu.com’)){
$s = 1;
}
else if(strstr(get_referer(),’google.com.hk’)){
$s = 1;
}
return $se;
}

When processing a form, you have to consider Discuz has already judged the possibility of static submission by users based on formhash

Here I use another way to determine the origin of the page. Of course, this method can also be used to forge the origin of HTTP_REFERER

The second part is to solve the problem that header('location: in PHP cannot get HTTP_REFERER for the next page after jumping to the page. Here we can only add a link to the page and then use js to simulate clicking the link, so that the next page will definitely Received HTTP_REFERER. Keyword: document.getElementById('gourl').click();

Recommended learning: php video tutorial

The above is the detailed content of How to use PHP to obtain referer and determine the source to prevent illegal access. For more information, please follow other related articles on the PHP Chinese website!