hi all, back again I love this forum, lol
below is a simple php class that generates a unique number thats included on all of my forms to prevent xss. admitadly the class was not originally mine just improved and customized a little.
anyways the problem is simple - in my __construct function the old form key is retreived from a global $_SESSION var and works great until a user opens a new tab with my page open, because I refresh the key on each page load the SESSION var is now wrong and their original tab open with my page will fail the xss and any form submission will error.
I am stumped at the moment of how else I should store this 'old formkey' that wont effect extra tabs.
as always ideas are appreciated, thanks
- free mp3 downloads and streaming
below is a simple php class that generates a unique number thats included on all of my forms to prevent xss. admitadly the class was not originally mine just improved and customized a little.
anyways the problem is simple - in my __construct function the old form key is retreived from a global $_SESSION var and works great until a user opens a new tab with my page open, because I refresh the key on each page load the SESSION var is now wrong and their original tab open with my page will fail the xss and any form submission will error.
I am stumped at the moment of how else I should store this 'old formkey' that wont effect extra tabs.
as always ideas are appreciated, thanks
Code:
<?php
/**
* Formkey.php
*
* This class is intended to protect forms from xss
*
* Customized by: Bladeone_2k - August 2010
*/
class formKey
{
private $formKey; //Here we store the generated form key
private $old_formKey; //Here we store the old form key (more info at step 4)
//The constructor stores the form key (if one exists) in our class variable
function __construct(){
//We need the previous key so we store it
if(isset($_SESSION['form_key'])){
$this->old_formKey = $_SESSION['form_key'];
}
//Generate the key and store it inside the class (one per page)
$this->formKey = $this->generateKey();
}
//Function to generate the form key
private function generateKey(){
//Get the IP-address of the user
$ip = $_SERVER['REMOTE_ADDR'];
//I use mt_rand() instead of rand() because it is better for generating random numbers.
//I use 'true' to get a longer string.
//See [URL unfurl="true"]http://www.php.net/mt_rand[/URL] for a precise description of the function and more examples.
$uniqid = uniqid(mt_rand(), true);
//Return the hash
return md5($ip . $uniqid);
}
//Function to output the form key
public function outputKey($html=0){
//Store the form key in the session
$_SESSION['form_key'] = $this->formKey;
//Output the form key
if($html == 0){
echo "<input type='hidden' name='form_key' id='form_key' value='".$this->formKey."' />";
} else {
return $this->formKey;
}
}
//Function that validated the form key POST data
public function validate(){
//echo $_POST['form_key'];
//echo $this->old_formKey; <----- I dont think it knows this?
//We use the old formKey and not the new generated version
if(isset($_POST['form_key'])){
if($_POST['form_key'] == $this->old_formKey){
//The key is valid, return true.
return true;
}
} else {
//The key is invalid, return false.
return false;
}
}
}
?>- free mp3 downloads and streaming
