Question

我似乎无法找到阻止我的网页被访问的方法。我有一个页面可以在mysql中为用户提供票证，但你可以直接输入http来接收票证，我如何阻止人们这样做？

<html>
<head>

<?php
header("refresh:33;url=tickets_give.php" );
?>

<link rel="stylesheet" href="finessecss.css">
</head>
<body bgcolor="#F9F9F9" background="background3.jpg">

<div class="videobox">

<div class="video"><p>Video Player Unavailable At This Moment</p></div>

<div class="clockbox">
<span id="countdown" class="timer"></span>
<script>
var seconds = 30;
function secondPassed() {
    var minutes = Math.round((seconds - 30)/60);
    var remainingSeconds = seconds % 60;
    if (remainingSeconds < 10) {
        remainingSeconds = "0" + remainingSeconds;  
    }
    document.getElementById('countdown').innerHTML = minutes + ":" + remainingSeconds;
    if (seconds == 0) {
        clearInterval(countdownTimer);
        document.getElementById('countdown')[0].innerHTML = "";
    } else {
        seconds--;
    }
}

var countdownTimer = setInterval('secondPassed()', 1000);

</script>
</div>
</div>

</body>
</html>

我的视频页面有我的代码

<?php

$servername = "localhost";
$username = "root";
$password = "";
$dbname = "users_database";
session_start();
$name = $_SESSION['name'];
$pass = $_SESSION['pass'];

if (!(isset($_SESSION['can_accesss']) && $_SESSION['name'] != '')) {
Header("Location:welcome_get.php");
}
unset($_SESSION['can_access']);

// rest of page code
// Create connection
$conn = mysqli_connect($servername, $username, $password, $dbname);
// Check connection
if (!$conn) {
    die("Connection failed: " . mysqli_connect_error());
}

if ('$access' == 'Finesseshopisthebest'){
    ;
}
else{
    echo'mysql' or die;
}

$sql = "UPDATE users_database SET tickets=tickets+10 WHERE username= '$name' and password= '$pass'";

if (mysqli_query($conn, $sql)) {
    Header("Location:tickets.php");
} else {
    echo "Error updating record: " . mysqli_error($conn);
}

mysqli_close($conn);

?>
</body>
</html>

那就是我的门票页面。我怎么阻止人们直接去ticket_give.php？

Answer 1

如果您正在寻找一个20秒的解决方案，只需检查是否存在精确的查询字符串，例如yoursite.com/somepage?foo=bar。如果未设置$_GET["foo"]，请致电exit并忘掉它。

警告：这是通过默默无闻的安全措施;任何有网络监视器甚至只是肩膀冲浪的人都会轻易过去，但我想它总比没有好。显然，一个更智能，更长期的解决方案是添加有意义的身份验证，但听起来你需要解决一个非常短期的问题！

如何使用php限制对页面的访问

1 个答案: