如何确保通过我的网站发送POST表单？ [关闭]

Question

I was wondering if there was a way to make sure a form sent through POST was from my website. I have looked at some tutorials and they suggested I use a "hidden" input value to verify, however this can quite pointless since anyone can view the html source of my website, gather information like the name attribute of the textboxes.

Let me know if I'm not being clear.

Only recently I started learning about the using PHP and ASP.NET to make websites. So, please be a little clear since I'm only a beginner. Thanks in advance.

Answer 1

You can check for the referrer url, if it's matches with your domain, then it's secure.

$ref = $_SERVER["HTTP_REFERER"];

Compare the value $ref with your domain name after splitting it to get only the domain name.