1

Is there a way I can select what URL or domain I recive POST data from using PHP.

For example, lets say I make a form submition from a domain called www.test.com and the form looks like this.

<form method="POST" action="www.domain2.com">
   <input type="text" name="test" value="1">
</form>

Is there any way for me in the php code on www.domain2.com get what domain that post data is comming in from (in this exmaple it would be "www.test.com")?

And if its possible, how do I do it?

Thanks for all help!

Anton Kihlström
  • 37
  • 1
  • 5

1 Answers1

0

If you have access to the code of both websites you can just add a hidden input that has the URL of the submitting form. Encrypt the data, send it, and then decrypt it.

how-to-encrypt-decrypt-data-in-php

Community
  • 1
  • 1
Haskell McRavin
  • 620
  • 5
  • 19
  • I know, but then the users have th possibility to change the value in the input while inspecting the element so i can't be sure its the correct URl then. – Anton Kihlström May 10 '17 at 16:17
  • You'll have to encrypt the value then and unencrypt it on the other side and then check the string with a regex or something of the like. – Haskell McRavin May 10 '17 at 16:18
  • Still, someone can steel the value and use it in their own form from another website if its inside a input tag, right? – Anton Kihlström May 10 '17 at 16:22
  • Honestly, this is a low quality answer. It should contain an example of code; one that works, since it could be anything. – Funk Forty Niner May 10 '17 at 16:23
  • if you're using proper encryption the value will be different every time even if the input is the same. – Haskell McRavin May 10 '17 at 16:26
  • Ah okey, can you link me or show me an exmaple of a encryption like that? – Anton Kihlström May 10 '17 at 16:28
  • But actually I still dont think this fixes the problem I have, because cant they still load the website and steel the encrypted value and then submit it from thir own website? – Anton Kihlström May 10 '17 at 16:31
  • If they could encryption wouldn't be worth much... No that's the point of encryption. People that don't have the keys to decrypt your information can't get that information. People without the needed salt and keys can't encrypt information like you encrypt information so if you unencrypt data they tried to encrypt and send to you it it will be gibberish and you could detect that. – Haskell McRavin May 10 '17 at 16:44
  • Proper encryption is hard, but its the only real additional protection you can give yourself aside from from the protection you get from SSL. – Haskell McRavin May 10 '17 at 16:50