blocks|key|2062251|text|您需要检查'HTTP_REFERER‘键的$_SERVER数组。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2062252|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

You need to examine the $_SERVER array for the 'HTTP_REFERER' key.

blocks|key|2062436|text|是的，但请记住，一些代理和其他东西剥离了这些信息，它很容易被伪造。所以永远不要依赖它。例如，不要认为您的web应用程序会受到CSRF的保护，因为您会检查referrer以匹配您自己的服务器。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2062437|$referringSite+=+$_SERVER['HTTP_REFERER'];+//+is+that+spelt+wrong+in+PHP+?|code-block|syntax|javascript|2062438|如果您希望只允许来自特定域的请求，则需要解析一些URL以获取顶级域。随着我学到更多，这可以用PHP的parse_url()来完成。|2062439|正如andyk在评论中指出的那样，您还必须考虑到www.example.com和example.com。|2062440|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/Cross-site_request_forgery|1|http://au.php.net/function.parse-url|2|https://stackoverflow.com/users/26721/andyk^0|1Q|4|0|0|0|1E|B|1|0|2|5|2|0^^$0|@$1|2|3|4|5|6|7|Y|8|@]|9|@$A|Z|B|10|1|11]]|C|$]]|$1|D|3|E|5|F|7|12|8|@]|9|@]|C|$G|H]]|$1|I|3|J|5|6|7|13|8|@]|9|@$A|14|B|15|1|16]]|C|$]]|$1|K|3|L|5|6|7|17|8|@]|9|@$A|18|B|19|1|1A]]|C|$]]|$1|M|3|-4|5|6|7|1B|8|@]|9|@]|C|$]]]|N|$O|$5|P|Q|R|C|$S|T]]|U|$5|P|Q|R|C|$S|V]]|W|$5|P|Q|R|C|$S|X]]]]

Yes, but keep in mind some proxies and other things strip this information out, and it can be easily forged. So never rely on it. For example, don't think your web app is secure from <a href="http://en.wikipedia.org/wiki/Cross-site_request_forgery" rel="nofollow noreferrer">CSRF</a> because you check the referrer to match your own server.

<pre><code>$referringSite = $_SERVER['HTTP_REFERER']; // is that spelt wrong in PHP ?
</code></pre>

If you want to only allow requests from a specific domain you'll need to parse some of the URL to get the top level domain. As I've learned more, this can be done with PHP's <a href="http://au.php.net/function.parse-url" rel="nofollow noreferrer">parse_url()</a>.

As <a href="https://stackoverflow.com/users/26721/andyk">andyk</a> points out in the comments, you will also have to allow for www.example.com and example.com.

blocks|key|2062442|text|虽然你可以在$_SERVER['HTTP_REFERER']上获得推荐站点，但不要把赌注押在它上面。浏览器设置了这个头，它很容易被欺骗。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|2062443|如果只有来自特定推荐人的人访问你的站点是很重要的，那么就不要使用这种方法。您必须找到另一种方法来保护您的内容，比如基本身份验证。我并不是说你不应该使用这种技术，只是要记住它不是万无一失的。|2062444|顺便说一句，您还可以在apache级别的using+mod_rewrite上阻止引用。|2062445|entityMap|0|LINK|mutability|MUTABLE|url|http://www.htaccess-guide.com/index.php?a=7^0|6|O|0|0|K|H|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@$9|S|A|T|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|U|8|@]|D|@]|E|$]]|$1|H|3|I|5|6|7|V|8|@]|D|@$9|W|A|X|1|Y]]|E|$]]|$1|J|3|-4|5|6|7|Z|8|@]|D|@]|E|$]]]|K|$L|$5|M|N|O|E|$P|Q]]]]

While you can look at <code>$_SERVER['HTTP_REFERER']</code> to get the referring site, don't bet the farm on it. The browser sets this header and it's easily spoofed.

If it's critical that only people coming from specific referrers view your site, don't use this method. You'll have to find another way, like basic auth, to protect your content. I'm not saying that you shouldn't use this technique, just keep in mind that it's not fool-proof.

BTW, you can also block referrers at the apache level <a href="http://www.htaccess-guide.com/index.php?a=7" rel="noreferrer">using mod_rewrite</a>.

blocks|key|2062447|text|你不能信任推荐人。尽管它来自火狐数组，但它实际上是用户/浏览器提供的值，并且很容易使用诸如$_SERVER+RefControl+addon之类的东西来伪造。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|2062448|entityMap|0|LINK|mutability|MUTABLE|url|https://addons.mozilla.org/en-US/firefox/addon/953^0|19|8|1I|G|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@$9|O|A|P|B|C]]|D|@$9|Q|A|R|1|S]]|E|$]]|$1|F|3|-4|5|6|7|T|8|@]|D|@]|E|$]]]|G|$H|$5|I|J|K|E|$L|M]]]]

You cannot trust the referrer. Despite coming from the <code>$_SERVER</code> array, it is actually a user/browser supplied value and is easily faked, using such things as the Firefox <a href="https://addons.mozilla.org/en-US/firefox/addon/953" rel="nofollow noreferrer">RefControl addon</a>.

Is it possible to check who is entering your website in PHP. I have a web application ( written in PHP) that should only allow users entering from some particular websites. Is it possible to get the referral websites by examining the <code>_Request</code> object? If yes, how?

Inspect the referrer in PHP

身份验证

服务器

有没有可能用PHP检查谁在进入你的网站？我有一个网络应用程序(用PHP编写)，应该只允许用户从一些特定的网站进入。是否可以通过检查_Request对象来获取推荐网站？如果是，是如何实现的？

问检查PHP中的referrer
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问检查PHP中的referrerEN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问检查PHP中的referrer
EN