Question

Ive been struggling with this for a day or two. Not just the coding but explaining the situation precisely. I have a static form on a page, “download-registration.php” when you submit the form (validated CS and SS) it then takes you to “download-software.php” where you can well, download the software. I do not want “download-software.php” to be accessible from anywhere but “download-registration.php” and ONLY after you submit the form. This is the problem I was having with a session based restriction, you could go to “download-registration.php” and alter the url to get to the download page.

I think I need to create a variable (random 1, 65335)? insert that value into a hidden input on click and make sure it matches to a value on the “download-software.php” page?

How do I go about this? does it need to be done this way or is there a better way? Any help is much appreciated!

Answer 1

Make whatever you have that processes the form you want to force them to submit also add a variable to the session. Then check to see if that variable is set on the download page.

My guess is that with your earlier session-based approach you were setting something in the session when the form was loaded, but you need to do it when you process it instead if you want to make sure they submit it first.

Edit:

display_form.php:

// ... display the form, you don't need to set any $_SESSION here ...

process_form.php

session_start();

// ... process the form ...

$_SESSION['form_processed'] = 1

// ... redirect to download page ...

download_page.php

session_start();

if($_SESSION['form_processed'] != 1) {
    // user never submitted form, reject them ...
} else {
    // user submitted the form, show them the download page
}