Home/ Questions/Q 9030605
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-16T07:31:56+00:00

I have this case : I have a file named form.php and it contains

  • 0

I have this case :

I have a file named form.php and it contains just simple HTML form with POST method and the ‘action’ file of that form always on different file, let’s say : action.php. all of this scripts stored under a domain named : realdomain.com (just an example).

today, I created a fake form from another domain (example : fakedomain.com), then I put this : action="http://realdomain.com/action.php" then hit the submit button and action.php on realdomain.com can’t distinguish if it’s from realdomain.com or fakedomain.com and let it goes through just like that…

Then I have an idea to put some ‘filter’ on the action.php to ONLY process the variables submitted if the referred domain is realdomain.com using $_SERVER['HTTP_REFERER'].

But again, in some forums or blog post, this method is not reliable at all since HTTP_REFERER can be faked too.

So, how to validate this? I mean, how to make action.php ONLY process variables submitted from same server?

thanks

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You can implement CSRF protection in your form, a good tutorial: http://phpmaster.com/preventing-cross-site-request-forgeries/

    Sorry for the short answer but I am writting on an iphone.

    • 0