Stop XS posting?

[Username:]

I've tried this:

<?php
$xsblock = $_SERVER['HTTP_REFERER'];
$url = "testchan";
$pos = strpos($xsblock, $url);
if ($pos == false) {
die();
} else {
echo "content content content content content content content content";
}
?>

 

How can I do this correctly?

Thanks in advance! 

[joel24]

should work, the $_SERVER['http_referer'] must not be getting set...

 

i.e. try this

//print $_server variables to see that the referer is being set.
print_r($_SERVER);

//test code
$xsblock = "http://www.bob.com/testchan";
$url = "testchan";
$pos = strpos($xsblock, $url);
if ($pos == false) {
echo "not found";
} else {
echo "found";
}

 

[Username:]

should work, the $_SERVER['http_referer'] must not be getting set...

 

i.e. try this

//print $_server variables to see that the referer is being set.
print_r($_SERVER);

//test code
$xsblock = "http://www.bob.com/testchan";
$url = "testchan";
$pos = strpos($xsblock, $url);
if ($pos == false) {
echo "not found";
} else {
echo "found";
}

It works fine, but anyone can easily put testchan in the url lol. Was just wondering if there's a better method of doing it.

Sorry, should've said that in the original post

[Username:]

How could I do something like this?

 

$xsblock = $_SERVER['HTTP_REFERER'];
$url = array('testchan.','/testchan');
$pos = strpos($xsblock, $url);
if ($pos == false) {
die("no");
} else {
echo "content content content content content content";
}

[PFMaBiSmAd]

HTTP_REFERER provides no real security. Web proxy scripts and spam bot scripts set it to match the site being requested.

 

You would need to set a session variable when your form is produced and check that it is set in the form processing code. Unset the session variable in your form processing code so that only one submission can be made for each visit to the form.

 

This will at least require that something visits your form before submitting to your form processing code and supports passing the session id between pages.

[roopurt18]

What exactly are you trying to accomplish here?

[Username:]

What exactly are you trying to accomplish here?

 

really?.. 

[Username:]

i'm blocking cross-site posting or url-malforming posting etc

Cause from the posting script page, I can do something like

"www.url.com/post.php?body=TEXT1&name=TEXT2&submit=Submit" and spam it in the address bar and mega-post

 

nevermind, just gonna implement recaptcha. This was fun to mess around with.

[roopurt18]

What exactly are you trying to accomplish here?

really?.. 

 

Yes, really.  As PFMaBiSmAd pointed out HTTP_REFERER can be faked so provides no real security.  There are different ways in which someone can perform cross-site attacks and which method you're trying to prevent will guide the solution you use.

[Username:]

What exactly are you trying to accomplish here?

really?.. 

 

Yes, really.  As PFMaBiSmAd pointed out HTTP_REFERER can be faked so provides no real security.  There are different ways in which someone can perform cross-site attacks and which method you're trying to prevent will guide the solution you use.

I realize that a referrer can be spoofed. Why do you think I just decided to use reCAPTCHA?