Question

I have been googling a lot but i am still without an answer so i decided to ask this question here:
Is there a way in PHP how to check that the data i am receiving in some script are from the specific form on the page? I am asking because everyone can see the name of the script i am using for saving the data to my database, so if somebody is able to find out the whole URL, he is also able to send some fake data to the script and i need a condition, that the saving process is triggered only when the data comes from the proper form on my page.

I am using jQuery to call AJAX function, so basically if i click on the button “send”, the $.POST() method is triggered to call the script for saving the data.

Thanks,
Tomas

Answer 1

Use tokens to check if request is valid

You could always add some kind of security token when submitting data:

Tokens can be easily extended for many different uses and covers wide area when it comes to checking if some request is valid, for example you could let your non critical forms open for public, ask users to get their secret keys from some page (forcing them to open that page) and then use those keys to identify them when submitting data.

Of course all of this can be completely transparent to user as you could give keys from front page via cookies (or session cookies, it does not matter here, no more or less security as server keys should change after use and invalidate within specified time or when user’s identity changes).
In this example of use, only user that opened front page can submit data to server.

Another case is when cookies is given away at same page which contains form for submitting data to server. Every user that open page will have their keys to submit data straight away, however if someone tries to make request from outside it will fail.
See OWASP Cross Site Request Forgery
and codinghorror.com Blog CSRF and You

Only with AJAX?

Here is my answer to another question, this answer covers different methods for inserting additional data to ajax request: Liftweb: create a form that can be submitted both traditionally and with AJAX (take a closer look at

$.ajax({ 
    ... 
    data: /* here */ 
    ...

Currently I am using tokens this way:

Form used to submit

This hidden input can be added to form, it is not requirement as you can use methods described earlier at another answer.

<input type="hidden" name="formid" value="<?php echo generateFormId(); ?>" />

Function generateFormId()

Simply generate random string and save it to session storage

function generateFormId() {
    // Insert some random string: base64_encode is not really needed here
    $_SESSION['FORM_ID'] = 'FormID'.base64_encode( uniqid() );
    // If you want longer random string mixed with some other method just add them:
    //$_SESSION['FORM_ID'] = 'FormID'.base64_encode( crypt(uniqid()).uniqid('',true) );
    return $_SESSION['FORM_ID'];
}

Processing submitted form data

if (!isset($_SESSION['FORM_ID']) || $_SESSION['FORM_ID'] != $_POST['formid']) {
    // You can use these if you want to redirect user back to form, preserving values:
    //$_SESSION['RELOAD_POST'] = $_POST;
    //$_SESSION['RELOAD_ID'] = uniqid('re');
    echo 'Form expired, cannot submit values.';
    //echo '<a href="form.php?reload='.$_SESSION['RELOAD_ID'].'">Go back and try again</a>';
    exit(1); // <== Stop processing in case of error.
}

If you need to check which form is submitting data

Then you could just add prefix when generating id’s and check for that prefix when processing form data.

This is case when one php script deals with many different forms.

---

Remember that only ultimate answer to prevent evil users is to pull off all wires from your server…