/    Sign up×
Community /Pin to ProfileBookmark

I don’t know if this is possible in PHP or not, but is there a way to detect if a link has been clicked? In my member area, I need there to be a way to change a security token’s value if the user visits a different page of the member area.

to post a comment
PHP

15 Comments(s)

Copy linkTweet thisAlerts:
@biyushDec 08.2008 — Hi,

$query = "SELECT user_id, username FROM users WHERE user_id = ? AND username = ?"; [/QUOTE]

thanks

Biyush
Copy linkTweet thisAlerts:
@MindzaiDec 08.2008 — The only way PHP can be aware that a link is clicked if the link is to a php script. If you have a header php file you could place some login in there to update the token.
Copy linkTweet thisAlerts:
@Joseph_WitchardauthorDec 08.2008 — What do you mean, exactly?
Copy linkTweet thisAlerts:
@MindzaiDec 08.2008 — sorry that should say logic not login
Copy linkTweet thisAlerts:
@Joseph_WitchardauthorDec 09.2008 — When you say PHP script, does that many any page with the .php extension? Can it be a page that contains PHP code, but doesn't do much with it as far as significance goes? In other words, something like:

[code=php]header("Location: redirect_here.php");[/code]
Copy linkTweet thisAlerts:
@NogDogDec 09.2008 — You can look at the $_SERVER['HTTP_REFERER'] value to see what, if any, URL the browser claims to have accessed your page from, but it is not a required HTTP header, may not be sent do to privacy settings or proxy settings, and can be easily spoofed. Therefore it can be used as a guide to what your processing does, but should never be depended upon for anything at all critical.
Copy linkTweet thisAlerts:
@Joseph_WitchardauthorDec 09.2008 — So that would be something like:

Page one:
[code=php]$_SERVER['USER_AGENT'] = 'url';
echo "<a href='$_SERVER['USER_AGENT']'>url</a>";[/code]


Page two:
[code=php]if ($_SERVER['HTTP_REFERER'] == 'url')
{

// set something

}[/code]


Right? Also, do both of those superglobals work with https?
Copy linkTweet thisAlerts:
@NogDogDec 09.2008 — No, it would be something like:

page_one.php:
[code=php]
<a href="page_two.php">Go to page two</a>
[/code]

page_two.php:
[code=php]
if(!empty($_SERVER['HTTP_REFERER']) and
stripos($_SERVER['HTTP_REFERER'], 'yourdomain.com/page_one.php') !== false)
{
echo "I'm pretty sure you got here from page one.";
}
[/code]

But again, this is only useful as a general information sort of thing that does not have to be 100% correct. If you need something more dependable, then you are probably looking at something using sessions, such as:

page_one.php:
[code=php]
<?php
session_start();
$_SESSION['token'] = uniqid('',true);
?>
<a href="page_two.php?id=<?php echo $_SESSION['token']; ?>">Go to page 2</a>
[/code]

page_two.php:
[code=php]
<?php
session_start();
if(isset($_GET['id']) and isset($_SESSION['token']) and
$_GET['id'] == $_SESSION['token'])
{
echo "I'm even more sure you got here from page one.";
}
[/code]
Copy linkTweet thisAlerts:
@Joseph_WitchardauthorDec 09.2008 — Well the reason I was asking is because my book acted like you should generate a new token every time an important action takes place. My plan was to generate a new token if PHP was certain the user had gotten there from that page. Not a good idea?

Also, just so I'll know for reference purposes if it's not a good idea, does that superglobal work with https?
Copy linkTweet thisAlerts:
@MindzaiDec 09.2008 — If by token you mean session id, there's really no need to regenerate an id every time a user changes page. I tend to do it after 'important' actions, such as logging in/out etc.
Copy linkTweet thisAlerts:
@Joseph_WitchardauthorDec 09.2008 — Technically, though, wouldn't doing that make your scripts more secure? And yes, I know I'm being paranoid.
Copy linkTweet thisAlerts:
@MindzaiDec 09.2008 — Technically yes, and from what I gather (not done any real testing) there is no real performance hit so if you feel safer go for it. If you're super paranoid you could also store as much user specific info as possible in your session (ip address, user agent, login microtime etc) as well and verify that for a belt and braces approach (no bad thing).
Copy linkTweet thisAlerts:
@skywalker2208Dec 09.2008 — Which book are you using?
Copy linkTweet thisAlerts:
@Joseph_WitchardauthorDec 10.2008 — Essential PHP Security, by Chris Shiflett.
×

Success!

Help @Joseph_Witchard spread the word by sharing this article on Twitter...

Tweet This
Sign in
Forgot password?
Sign in with TwitchSign in with GithubCreate Account
about: ({
version: 0.1.9 BETA 5.7,
whats_new: community page,
up_next: more Davinci•003 tasks,
coming_soon: events calendar,
social: @webDeveloperHQ
});

legal: ({
terms: of use,
privacy: policy
});
changelog: (
version: 0.1.9,
notes: added community page

version: 0.1.8,
notes: added Davinci•003

version: 0.1.7,
notes: upvote answers to bounties

version: 0.1.6,
notes: article editor refresh
)...
recent_tips: (
tipper: @AriseFacilitySolutions09,
tipped: article
amount: 1000 SATS,

tipper: @Yussuf4331,
tipped: article
amount: 1000 SATS,

tipper: @darkwebsites540,
tipped: article
amount: 10 SATS,
)...