etrader Posted May 19, 2011 Share Posted May 19, 2011 I have a php form for uploading file as the action sends to upload.php. How I can avoid any kind of direct access to upload.php? I want to kill the php process at the first line without performing the remaining code (it is very critical for me as I have a counter), except calls coming from form.php. Quote Link to comment https://forums.phpfreaks.com/topic/236880-avoinding-direct-access/ Share on other sites More sharing options...
markjoe Posted May 19, 2011 Share Posted May 19, 2011 define() a constant in the first script. check for it in upload.php, if notdefined, kill it. Quote Link to comment https://forums.phpfreaks.com/topic/236880-avoinding-direct-access/#findComment-1217639 Share on other sites More sharing options...
wildteen88 Posted May 19, 2011 Share Posted May 19, 2011 If you have named your submit button in your form then check for the $_POST['submit_button_name'] variable in exists in upload.php, eg if(isset($_POST['submit'])) { // add the code for uploading the images here } else { // display error or redirect back to form.php here } Quote Link to comment https://forums.phpfreaks.com/topic/236880-avoinding-direct-access/#findComment-1217641 Share on other sites More sharing options...
markjoe Posted May 19, 2011 Share Posted May 19, 2011 Sorry, I didn't play close enough attention that you are going through an html form. However, post variables and headers can be spoofed, so while either will work, they are not 100% reliable. If you want to be 100% sure, you would need to use a server side cache such as APC. Or stepping outside of php, I think the best solution is defining a rule in .htaccess. Quote Link to comment https://forums.phpfreaks.com/topic/236880-avoinding-direct-access/#findComment-1217705 Share on other sites More sharing options...
waynew Posted May 19, 2011 Share Posted May 19, 2011 Define a constant on the main page and check to see if that constant has been defined before running the upload script. Quote Link to comment https://forums.phpfreaks.com/topic/236880-avoinding-direct-access/#findComment-1217731 Share on other sites More sharing options...
Stooney Posted May 19, 2011 Share Posted May 19, 2011 Is the upload from being drawn with php via a templating system or anything? If so you could include a randomly generated string with the login form, which is stored in a database, then checked for in upload.php. That would make it so that any submission would have to come from you upload form. Quote Link to comment https://forums.phpfreaks.com/topic/236880-avoinding-direct-access/#findComment-1217743 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.