如何防止其他网站在PHP中将帖子数据发送到我的网站

Question

What is the best method to stop other websites from sending data to my website in PHP?

I googled it and found I need to use Hash. But there are different Hashes, which one to use? Let's say, I pick sha1

Now, how exactly can I prevent other websites from sending post data to my website with sha1

I am bit confused, can someone show me a little demo code.

This is the code, I thought, but it is not flawless..

Index.php page:

$password = sha1("toby123");

<form method="post" action="insert.php" />
<input type="text" name="username"/>
<input type="password" name="password"/>
<input type="hidden" name="hiddenpass" value=" ".$password." "/>
</form>

Insert Into Database PHP Page:

$hiddenpass = "toby123" 

if (  $_POST["hiddenpass"] == "sha1($hiddenpass )"  )

{
// INSERT THE DATA
}

But the problem here is, hash code in the form will be visiable to everyone. What if someone crack it?

I mean, by using a Hit & Trial method???

Is my method 100% safe??

Edit:

This is my new code after looking at one of the answer, but the If condition is always false.

Index.php Page

<?php
// Start the session
session_start();


    $token = bin2hex(random_bytes(32));

    if (!isset($_SESSION['token'])) {
        $_SESSION['token'] = $token;
    }

?>

Insert.php Page:

session_start();

echo $_SESSION['token'];
echo '<br/>';
echo $_POST['token'];

if (  ( isset($_SESSION['token']) )  &&  ( $_POST['token'] == $_SESSION['token'] ) )

{

// Insert Data

}
else
echo "<br/>Something went wrong";


unset($_SESSION['token']);

Output:

055442be59701631db6ed88dc341027ebf2238507bb9a72f1caefd6d3b126a4b

055442be59701631db6ed88dc341027ebf2238507bb9a72f1caefd6d3b126a4b

Something went wrong

Answer 1

You should be securing your forms by adding using CSRF tokens. The CSRF token should always be random. CSRF stands for (Cross Site Request Frogery)

---

Here is a good and secure method:

<?php

function random_token()
{

    $token = bin2hex(random_bytes(32));

    return $token;
}


function gentoken()
{
    if (!isset($_SESSION['token'])) {
        $_SESSION['token'] = random_token();
    }
}


function checktoken($token)
{
    if (isset($_SESSION['token']) && $token === $_SESSION['token']) {
        deletetoken();
        return true;
    }
    return false; // default
}


function deletetoken()
{
    unset($_SESSION['token']);
}

?>

And here should be your form

<form method="post" action="insert.php"/>
<input type="text" name="username"/>
<input type="password" name="password"/>
<input type = "hidden" name="token" value="' . $_SESSION['token'] . '">
<input type = "submit" name="submit" value="Insert"/>
</form>

When the page starts, write this:

gentoken();

**And to check for the token do this**



if (isset($_POST['submit'])) {

    $token = $_POST['token'];
    if (checktoken($token)) {

    } else {
        echo "Something wrong happened"; //When the token is changed or doesn't match!
    }

}

---

Notes:

random_bytes() generates secure cryptographical bytes and doesn't need to be hashed!

I hope this helped. Good luck!