Hi, I am a beginner in PHP.
How can I restrict user access to controller.php and allow access to it only via view.php?
My proposal:
I don't know if this is proper, or how to avoid robots accessing it directly.
view.php:
<?php
session_start();
$_SESSION['isFromView'] = true;
?>
<html>
<body>
<form action="controller.php">
<input type="submit"/>
</form>
</body>
</html>
controller.php
<?php
session_start();
if(!isset($_SESSION['isFromView'])||!$_SESSION['isFromView']){exit();}
else{
//code here
$_SESSION['isFromView']=false;
}
?>
Please write what do I miss and in which way my controller can be access directly or other security problem (if you can examples please).
Edit:
In case that I dont have user login it can be secured by killing the session it controller.php after code executed, then when the user return to view.php new session ID will be created.
In most cases, though, we cannot kill the session because of other components of the site.
Thanks