Posted By

luizlopes on 01/21/09

Tagged

Versions (?)

Last Edited at 01/21/09 01:20pm

Statistics

Viewed 1006 times

Favorited by 1 user(s)

Related snippets

Prevent Remote Form Submit

/ Published in: PHP

[quote]$_SERVER['HTTP_REFERRER']'s problem is that can be spoofed, but it's better than nothing if you really want that.[/quote]

Expand | Embed | Plain Text

Copy this code and paste it in your HTML

if ($_SERVER['REQUEST_METHOD'] == 'POST') // or possibly,  count($_POST) > 0
{
    $host = preg_replace('#^www\.#', '', $_SERVER['SERVER_NAME']);
 
    if ($host AND $_SERVER['HTTP_REFERER'])
    {
        $refparts = @parse_url($_SERVER['HTTP_REFERER']);
        $refhost  = $refparts['host'] . ((int)$refparts['port'] ? ':' . (int)$refparts['port'] : '');
 
        if (strpos($refhost, $host) === false)
        {
            die('POST requests are not permitted from "foreign" domains.');
        }
    }
}