Stop Post Data From Different Domain PHP

Question

I'm a beginner in PHP.

What I'm trying to do is stop Post Data coming from another webpage.

The problem I am having is let's say someone copies my form and pastes it in their website. I want to be able to stop that Post Data from running the script on my email form.

How can I do this? Let me know if I'm not being clear enough.

My PHP Contact form runs on one page with conditional statements. i.e. if data checks out, submit.

Answer 1

$_SERVER['HTTP_Referrer'] would be nice but it isn't reliable. You could use a hidden form field that MD5's something and then you check it on the other side.

Answer 2

If you're looking for a quick-and-dirty approach, you can check the REFERER header.

If you really want to make sure that the form was fetched from your site though, you should generate a token each time the form is loaded and attach it to a session. A simple way to do this would be something like:

$_SESSION['formToken'] = sha1(microtime());

Then your form can have a hidden input:

<input type="hidden" name="token" value='<?=$_SESSION['formToken'];?>' />

and you can check that when deciding whether to process your form data.

Answer 3

You're trying to prevent CSRF - Cross-Site Request Forgery. Jeff himself has a blog article about this.

True XSRF Prevention requires three parts:

• Hidden Input Fields, to prevent someone from just snatching the form and embedding it
• Timechecking within an epsilon of the form being generated, otherwise someone can generate a valid form once and use the token (depending on impementation/how it's stored)
• Cookies: this is to prevent a malicious server from pretending it's a client, and performing a man-in-the-middle attack

Answer 4

Add two hidden fields like this:

<?php
$time = time();
$_SESSION['time'] = $time;
/*
 *This is a Perfect Password from Steve Gibbson's site https://www.grc.com/passwords.htm
 *It should make for a great Salt.
 */
$salt = 'b79jsMaEzXMvCO2iWtzU2gT7rBoRmQzlvj5yNVgP4aGOrZ524pT5KoTDJ7vNiIN';
$token = sha1($salt . $time);
?>
<input type="hidden" name="token" value="<?php echo $token; ?>" />

Then when you do the authentication you'll use code like this:

<?php
$salt = 'b79jsMaEzXMvCO2iWtzU2gT7rBoRmQzlvj5yNVgP4aGOrZ524pT5KoTDJ7vNiIN';
$token = sha1($salt . $_SESSION['time']);
if($token != $_POST['token'])
{
die('you stupid scum sucking bandwidth hog!');
}
//Rest of form validation
?>

This is not a perfect system and it could be cracked, however one of 2 things would be needed to crack it:

1. Your salt (be sure you keep it secure)
2. ALOT of time, this could take several thousands of years to brute force so don't worry about this.

EDIT: I updated my answer to account for the obvious mistake I made, pass at least the time variable in the session if not both, the time and the hash. Assuming that your using server-side sessions and not cookie sessions then they cannot be tampered with unless someone has access to the server, in which case your already screwed.

Answer 5

In the form:

<?
$password = "mypass"; //change to something only you know
$hash = md5($password . $_SERVER['REMOTE_ADDR']);
echo "<input type=\"hidden\" name=\"iphash\" value=\"$hash\"/>";
?>

When you are checking:

$password = "mypass"; //same as above
if ($_POST['iphash'] == md5($password . $_SERVER['REMOTE_ADDR'])) {
    //fine
}
else {
    //error
}