PHP防cookie欺骗,[PHP]php的sessionid可以伪造，不要用来做防刷新处理

如果是基于session或者cookie做防止刷新，那么，我可以伪造状态，用xmlhttp把服务器刷爆

代码如下，服务器端的代码在最后一个textarea里.

/p>

Transitional//EN">

xmlhttp

rows="10" cols="90" >

require_once('echo.php');

session_start();

//pr($_COOKIE);pr($_GET);pr($_POST);

//pr($_SESSION);pr($_COOKIE);

if ( $_SESSION['posted'] == 1 ) {

echo"error";

DIE;

}

//get cookie number

$num = $_COOKIE['currNum'];

$expires = time()+60*60*24*365;

if (!isset($_COOKIE['currNum'])) {

setcookie('currNum' , 1 , $expires );

echo

"cookie没有设置\n";

}

else {

$num++;

setcookie('currNum',$num);

echo $num;

}

?>

*{font:12px verdana;}

foreach ($_POST as $key=>$v) {

$$key = $v;

$str .=$v."\r\n";

//echo "$v \n";

}

//print_R($_SERVER);

foreach ($_SERVER as $k=>$v) {

$str .=$k."=".$v."\n";

}

echo $str;

$fp = fopen("d:/tmp/".$num.".txt","wb");

//fwrite($fp,$str);

fclose($fp);

$_SESSION['posted'] = 1;

?>