国产av日韩一区二区三区精品,成人性爱视频在线观看,国产,欧美,日韩,一区,www.成色av久久成人,2222eeee成人天堂

Table of Contents
Generate and Store Anti-CSRF Tokens
Validate the Token on Form Submission
Don’t Forget AJAX Requests and APIs
Bonus Tips: SameSite Cookies and HTTP-Only Forms
Home Backend Development PHP Tutorial How do I prevent cross-site request forgery (CSRF) attacks in PHP?

How do I prevent cross-site request forgery (CSRF) attacks in PHP?

Jun 28, 2025 am 02:25 AM
php csrf

To prevent CSRF attacks in PHP, implement anti-CSRF tokens. 1) Generate and store secure tokens using random_bytes() or bin2hex(random_bytes(32)), save them in $_SESSION, and include them in forms as hidden inputs. 2) Validate tokens on submission by strictly comparing the POST token with the session-stored one; reject mismatched requests with a 403 error. 3) Protect AJAX/API requests by including the token in headers or body, often retrieved from a meta tag. 4) Use htmlspecialchars() when outputting tokens to prevent XSS leaks. 5) Regenerate tokens after critical actions like login. 6) Set SameSite=Strict/Lax for session cookies and avoid GET for state changes. 7) Re-authenticate users for sensitive actions. These steps ensure comprehensive CSRF protection across all request types while maintaining security integrity.

How do I prevent cross-site request forgery (CSRF) attacks in PHP?

To prevent CSRF attacks in PHP, you need to implement a solid anti-CSRF strategy—mainly by using tokens. The idea is simple: every state-changing request (like form submissions) should include a unique, unpredictable token that only the legitimate user knows. Without this token, the server shouldn’t process the request.

Here’s how to actually do it well in practice.


Generate and Store Anti-CSRF Tokens

Every time you display a form that performs an action (like submitting settings or making a purchase), generate a secure token and store it somewhere safe on the server side—like in the session.

  • Use random_bytes() or bin2hex(random_bytes(32)) to create a strong token.
  • Save it in $_SESSION so you can compare it later when the form is submitted.

For example:

if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(50));
}

Then in your form:

<input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">

This way, each form submission includes a token that the attacker can't guess or reproduce.


Validate the Token on Form Submission

When the form is submitted, check if the token in the POST data matches what’s stored in the session.

  • Always check for the presence of the token.
  • Compare it strictly (===) to avoid type-juggling issues.
  • If it doesn’t match, reject the request with a 403 error or similar.

Example code:

if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    http_response_code(403);
    die('Invalid CSRF token.');
}

A small but important detail: always use htmlspecialchars() when outputting the token into HTML to prevent XSS from leaking the token.

Also, don’t forget to rotate or regenerate the token after critical actions like login or password change.


Don’t Forget AJAX Requests and APIs

If your site uses JavaScript to submit forms or make API calls, those requests also need CSRF protection.

  • Include the CSRF token in the headers or body of the AJAX request.
  • You can store the token in a meta tag or inline script and read it from there when making the call.

For example, set a meta tag in your HTML head:

<meta name="csrf-token" content="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">

Then in your JS:

fetch('/update-profile', {
    method: 'POST',
    headers: {
        'X-CSRF-Token': document.querySelector('meta[name="csrf-token"]').content
    },
    body: new URLSearchParams({ name: 'John Doe' })
});

On the backend, look for the token in the X-CSRF-Token header and validate it just like with regular forms.

One thing to note: if you're building a single-page app (SPA) or mobile app that talks to your PHP backend, consider using same-site cookies and CSRF tokens together for better protection.


Bonus Tips: SameSite Cookies and HTTP-Only Forms

Even with tokens, there are extra steps you can take:

  • Set SameSite=Strict or Lax on your session cookie to reduce cross-origin requests.
  • Make sure your forms only accept POST requests where needed—don’t allow GET-based state changes.
  • For sensitive operations (like deleting an account), re-authentication helps add another layer.

These aren’t replacements for CSRF tokens, but they work well alongside them.


That’s basically it. CSRF protection in PHP boils down to generating good tokens, validating them properly, and making sure they’re included in all relevant requests. It’s not overly complex, but easy to mess up if you skip even one step.

The above is the detailed content of How do I prevent cross-site request forgery (CSRF) attacks in PHP?. For more information, please follow other related articles on the PHP Chinese website!

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undress AI Tool

Undress AI Tool

Undress images for free

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

How to combine two php arrays unique values? How to combine two php arrays unique values? Jul 02, 2025 pm 05:18 PM

To merge two PHP arrays and keep unique values, there are two main methods. 1. For index arrays or only deduplication, use array_merge and array_unique combinations: first merge array_merge($array1,$array2) and then use array_unique() to deduplicate them to finally get a new array containing all unique values; 2. For associative arrays and want to retain key-value pairs in the first array, use the operator: $result=$array1 $array2, which will ensure that the keys in the first array will not be overwritten by the second array. These two methods are applicable to different scenarios, depending on whether the key name is retained or only the focus is on

How to use php exit function? How to use php exit function? Jul 03, 2025 am 02:15 AM

exit() is a function in PHP that is used to terminate script execution immediately. Common uses include: 1. Terminate the script in advance when an exception is detected, such as the file does not exist or verification fails; 2. Output intermediate results during debugging and stop execution; 3. Call exit() after redirecting in conjunction with header() to prevent subsequent code execution; In addition, exit() can accept string parameters as output content or integers as status code, and its alias is die().

Applying Semantic Structure with article, section, and aside in HTML Applying Semantic Structure with article, section, and aside in HTML Jul 05, 2025 am 02:03 AM

The rational use of semantic tags in HTML can improve page structure clarity, accessibility and SEO effects. 1. Used for independent content blocks, such as blog posts or comments, it must be self-contained; 2. Used for classification related content, usually including titles, and is suitable for different modules of the page; 3. Used for auxiliary information related to the main content but not core, such as sidebar recommendations or author profiles. In actual development, labels should be combined and other, avoid excessive nesting, keep the structure simple, and verify the rationality of the structure through developer tools.

How to create an array in php? How to create an array in php? Jul 02, 2025 pm 05:01 PM

There are two ways to create an array in PHP: use the array() function or use brackets []. 1. Using the array() function is a traditional way, with good compatibility. Define index arrays such as $fruits=array("apple","banana","orange"), and associative arrays such as $user=array("name"=>"John","age"=>25); 2. Using [] is a simpler way to support since PHP5.4, such as $color

The requested operation requires elevation Windows The requested operation requires elevation Windows Jul 04, 2025 am 02:58 AM

When you encounter the prompt "This operation requires escalation of permissions", it means that you need administrator permissions to continue. Solutions include: 1. Right-click the "Run as Administrator" program or set the shortcut to always run as an administrator; 2. Check whether the current account is an administrator account, if not, switch or request administrator assistance; 3. Use administrator permissions to open a command prompt or PowerShell to execute relevant commands; 4. Bypass the restrictions by obtaining file ownership or modifying the registry when necessary, but such operations need to be cautious and fully understand the risks. Confirm permission identity and try the above methods usually solve the problem.

php raw post data php php raw post data php Jul 02, 2025 pm 04:51 PM

The way to process raw POST data in PHP is to use $rawData=file_get_contents('php://input'), which is suitable for receiving JSON, XML, or other custom format data. 1.php://input is a read-only stream, which is only valid in POST requests; 2. Common problems include server configuration or middleware reading input streams, which makes it impossible to obtain data; 3. Application scenarios include receiving front-end fetch requests, third-party service callbacks, and building RESTfulAPIs; 4. The difference from $_POST is that $_POST automatically parses standard form data, while the original data is suitable for non-standard formats and allows manual parsing; 5. Ordinary HTM

How to handle File Uploads securely in PHP? How to handle File Uploads securely in PHP? Jul 08, 2025 am 02:37 AM

To safely handle PHP file uploads, you need to verify the source and type, control the file name and path, set server restrictions, and process media files twice. 1. Verify the upload source to prevent CSRF through token and detect the real MIME type through finfo_file using whitelist control; 2. Rename the file to a random string and determine the extension to store it in a non-Web directory according to the detection type; 3. PHP configuration limits the upload size and temporary directory Nginx/Apache prohibits access to the upload directory; 4. The GD library resaves the pictures to clear potential malicious data.

How Do You Pass Variables by Value vs. by Reference in PHP? How Do You Pass Variables by Value vs. by Reference in PHP? Jul 08, 2025 am 02:42 AM

InPHP,variablesarepassedbyvaluebydefault,meaningfunctionsorassignmentsreceiveacopyofthedata,whilepassingbyreferenceallowsmodificationstoaffecttheoriginalvariable.1.Whenpassingbyvalue,changestothecopydonotimpacttheoriginal,asshownwhenassigning$b=$aorp

See all articles