阻止从其他页面提交表单

I have created this function:

function blacklisted_ip() {
    $('form').remove();
    $('.wrapper').removeClass('form-success');
    $(".login_text").html("Your IP has been blacklisted");
}

that removes a HTML form - I remove the form to stop users with a blacklisted IP logging in.

I have a php script at the top of the same page that processes the login when the form is posted.

Is there also a way i can stop other pages posting to this page?

the php starts like this:

if($_POST) {

}

I thought about adding a hidden field with a value in but then thought someone will be able to view the source and just copy it?

Best way to do this is using CSRF tokens. If you're suing any frameworks the they're already implemented out of the box, if not and if you want to implement it on your own you can do it.


CSRF stands for Cross-Site Request Forgery, which is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user’s web browser to perform an unwanted action on a trusted site for which the user is currently authenticated.

Reference: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet


Solution to prevent this is to have a unique CSRF tokens for each users for each form. When ever user opens the page and form is loaded you assign a token/key to that (page+form) and save that in session with expairy of your choice.

Add this token along with the form as hidden field and post that along with other datas, now when you process the form compare the token received from client side along with your sessions's token. If they match they're authenticated and if not don't process the form.

You can use any method to generate the CSRF tokens, in your case they would be just unique keys for each page+form.