PHP Development
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
 
User Name:
Password:
Remember me
 
Go Back   Dev Articles Community Forums > Programming > PHP Development
Reload this Page

How to protect a php file from misuse?

Discuss How to protect a php file from misuse? in the PHP Development forum on Dev Articles.
How to protect a php file from misuse? PHP Development forum to discuss anything related to developing applications in PHP. Topics include architecture, coding standards, and debugging methods.

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
« Previous Thread | Next Thread »  
Thread Tools Search this Thread Display Modes
 
Unread Dev Articles Community Forums Sponsor:
Stay one step ahead of the competition. Evaluate and give feedback on some of the hottest web development tools on the market today. Make your opinion heard! Click Here
  #1  
Old July 19th, 2004, 06:51 PM
Nemozob Nemozob is offline
Registered User
Dev Articles Newbie (0 - 499 posts)
  
Join Date: Jul 2004
Posts: 15 Nemozob User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 18 m 14 sec
Reputation Power: 0
How to protect a php file from misuse?
I have two files. One is an html page and in it is a call to a php page (I'm using it to generate a dynamic text png).

page_1.html
<html>
<img scr="heading.php?text=testing">
</html>

heading.php
<?php
php image generation stuff here
?>

I want to know if there's a way, using session variables or .htaccess protection or whatever, to allow users to load 'page_1.html' normally but not allow users to access 'heading.php' directly (by putting 'heading.php?text=some super long random text here' into their browsers).

My first thought was to have 'heading.php' only run when a certain variable was passed to it from 'page_1.html' but that hasn't worked correctly.

Any ideas?
Reply With Quote
  #2  
Old July 19th, 2004, 08:08 PM
dhouston's Avatar
dhouston dhouston is offline
Contributing User
Dev Articles Beginner (1000 - 1499 posts)
  
Join Date: May 2003
Location: Tennessee
Posts: 1,355 dhouston User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: < 1 sec
Reputation Power: 7
Send a message via ICQ to dhouston
Maybe do a referer check in the PHP file, looking for page_1.html. It's not foolproof, but it'd keep your average user from abusing the file.
__________________
Please don't PM me asking for solutions outside the scope of a thread.
Keeping all responses in a thread stands to help others who come along later,
which is after all what this forum's all about.
Reply With Quote
  #3  
Old July 19th, 2004, 11:00 PM
Nemozob Nemozob is offline
Registered User
Dev Articles Newbie (0 - 499 posts)
  
Join Date: Jul 2004
Posts: 15 Nemozob User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 18 m 14 sec
Reputation Power: 0
>Maybe do a referer check in the PHP file, looking for page_1.html. It's
>not foolproof, but it'd keep your average user from abusing the file.

How would that work if I had 100 HTML pages accessing the script? Could a referer check for and only allow requests coming from a certain directory?
Reply With Quote
  #4  
Old July 20th, 2004, 06:38 AM
dhouston's Avatar
dhouston dhouston is offline
Contributing User
Dev Articles Beginner (1000 - 1499 posts)
  
Join Date: May 2003
Location: Tennessee
Posts: 1,355 dhouston User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: < 1 sec
Reputation Power: 7
Send a message via ICQ to dhouston
Sure, you could look for a directory or even a domain. A domain would be preferable, in fact, as anyone on to your spoof check could create a directory on their server and get past your check without even having to write any spoof code.
Reply With Quote
  #5  
Old July 20th, 2004, 10:29 AM
Nemozob Nemozob is offline
Registered User
Dev Articles Newbie (0 - 499 posts)
  
Join Date: Jul 2004
Posts: 15 Nemozob User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 18 m 14 sec
Reputation Power: 0
So, the PHP file would check that the request was coming from:

http://www.domain.com/html/page_1.html

and the PHP could sit in

http://www.domain.com/php/heading.php

Is this correct? If you happen to know what the referer code might like that'd be great. But I will look around and try to figure it out. Thanks.
Reply With Quote
  #6  
Old July 20th, 2004, 10:52 AM
dhouston's Avatar
dhouston dhouston is offline
Contributing User
Dev Articles Beginner (1000 - 1499 posts)
  
Join Date: May 2003
Location: Tennessee
Posts: 1,355 dhouston User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: < 1 sec
Reputation Power: 7
Send a message via ICQ to dhouston
If you want to just check by domain, try:

PHP Code:
if(!preg_match("/domain\.com/",getenv("HTTP_REFERER"))){
    print "Access denied.";
    exit;
} 


To restrict access to a given page:

PHP Code:
if(!preg_match("/page_1\.html/",getenv("HTTP_REFERER"))){
    print "Access denied.";
    exit;
} 


Or for a directory:

PHP Code:
if(!preg_match("/\/html\//",getenv("HTTP_REFERER"))){
    print "Access denied.";
    exit;
} 


Note that dots and slashes have to be escaped within the preg_match() string. Other pattern matching functions could be used as well.
Reply With Quote
  #7  
Old July 20th, 2004, 12:53 PM
Nemozob Nemozob is offline
Registered User
Dev Articles Newbie (0 - 499 posts)
  
Join Date: Jul 2004
Posts: 15 Nemozob User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 18 m 14 sec
Reputation Power: 0
Great, thanks so much.
Reply With Quote
Reply

Viewing: Dev Articles Community Forums > Programming > PHP Development > How to protect a php file from misuse?

« Previous Thread | Next Thread »

Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Linear Mode Linear Mode
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump


Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 





© 2003-2008 by Developer Shed. All rights reserved. DS Cluster 4 hosted by Hostway.