How to use PHP to implement human-machine authentication and prevent malicious behavior

How to use PHP to achieve human-computer verification and prevent malicious behavior

With the rapid development of the Internet, network security issues have become increasingly prominent. The increase in malicious behavior has led to the need to take steps to protect the security of our website and our users. A common practice is to use human-to-bot verification techniques to differentiate between real users and bots. This article describes how to use PHP to implement human-machine authentication and prevent malicious behavior, and provides corresponding code examples.

1. Use verification code

Verification code is a basic human-machine verification technology that requires users to enter a verification code when submitting a form or performing certain operations to prove It's real users, not bots. The following is a sample code that uses PHP to implement a simple verification code:

<?php
session_start();
 
// 生成随机验证码字符串
$length = 6;   // 验证码长度
$chars = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
$randStr = '';
for($i = 0; $i < $length; $i++) {
  $randStr .= $chars[rand(0, strlen($chars) - 1)];
}
 
// 将验证码字符串保存到 session 中
$_SESSION['captcha'] = $randStr;
 
// 绘制验证码图片
$image = imagecreatetruecolor(100, 30);
$bgColor  = imagecolorallocate($image, 255, 255, 255);   // 背景颜色
$fontColor = imagecolorallocate($image, 0, 0, 0);   // 文字颜色
imagefill($image, 0, 0, $bgColor);
imagestring($image, 5, 25, 5, $randStr, $fontColor);
 
// 输出验证码图片
header('Content-Type: image/png');
imagepng($image);
imagedestroy($image);
?>

The above code generates a verification code string with a length of 6 and saves it to the session. While generating the verification code, a verification code picture is also drawn to display the verification code to the user.

2. Verify user input

When the user submits the form, it is necessary to verify whether the verification code entered by the user is correct. The following is a sample code that uses PHP to verify the verification code entered by the user:

<?php
session_start();
 
// 获取用户提交的验证码
$captcha = $_POST['captcha'];
 
// 获取保存在 session 中的验证码
$correctCaptcha = $_SESSION['captcha'];
 
// 验证用户输入的验证码是否正确
if($captcha === $correctCaptcha) {
  // 验证码正确，执行后续操作
} else {
  // 验证码错误，给出相应提示
}
?>

The above code obtains the verification code submitted by the user and obtains the correct verification code from the session. Then compare the two. If they are equal, it means that the verification code was entered correctly and subsequent operations can be performed; if they are not equal, it means that the verification code was entered incorrectly and a corresponding prompt needs to be given.

3. IP address restriction

In addition to using verification codes, access can also be restricted based on the user's IP address. For malicious behavior, bots are often used to attack, and the bot's requests often have similar IP addresses. Therefore, we can restrict based on the user's IP address. If the same IP address frequently visits the website in a short period of time, it may be a malicious behavior.

The following is a sample code that uses PHP to restrict access based on IP address:

<?php
$allow = true;   // 是否允许访问
 
// 获取用户的 IP 地址
$clientIP = $_SERVER['REMOTE_ADDR'];
 
// 获取用户访问的时间戳
$accessTime = time();
 
// 获取保存在 session 中的 IP 地址和访问时间
$sessionIP = $_SESSION['ip'];
$sessionTime = $_SESSION['time'];
 
// 判断用户与上一次访问的时间差
$timeDiff = $accessTime - $sessionTime;
if($timeDiff < 10 && $clientIP === $sessionIP) {
  $allow = false;   // 访问间隔过短，可能是恶意行为
}
 
// 更新 session 中的 IP 地址和访问时间
$_SESSION['ip'] = $clientIP;
$_SESSION['time'] = $accessTime;
 
// 输出结果
if($allow) {
  // 允许访问，继续执行后续操作
} else {
  // 不允许访问，给出相应提示
}
?>

The above code is judged by comparing the currently accessed IP address with the last accessed IP address, as well as the time interval. Whether access is allowed. If the same IP address is accessed multiple times in a short period of time, it may be malicious behavior.

Summary

This article introduces how to use PHP to achieve human-computer verification and basic methods to prevent malicious behavior, including using verification codes for verification and restrictions based on IP addresses. These methods can effectively protect the security of the website and users. Of course, there are other more advanced and complex techniques that can be used, but the above methods are already relatively common and simple. I hope readers will understand this and be able to apply it in actual projects. Continuously learning and improving one's own network security awareness is an important part of protecting the security of the website and users.

The above is the detailed content of How to use PHP to implement human-machine authentication and prevent malicious behavior. For more information, please follow other related articles on the PHP Chinese website!