Form Security (discussion)
- by Eray Alakese
I'm asking for brain storming and sharing experience.
Which method you are using for form submiting security ?
For example , for block automatically sended POST or GET datas, i'm using this method :
// Generating random string
<?php $hidden = substr(md5(microtime()) ,"-5"); ?>
<form action="post.php" ....
// assing this random string to a hidden input
<input type="hidden" value="<?php echo $hidden;" name="secCode>
// and then put this random string to a session variable
$_SESSION["secCode"] = $hidden;
**post.php**
if ($_POST["secCode"] != $_SESSION["secCode"])
{
die("You have to send this form, on our web site");
}
