php的sessionid可以伪造，不要用来做防刷新处理了 · php开发笔记

如果是基于session或者cookie做防止刷新，那么，我可以伪造状态，用xmlhttp把服务器刷爆代码如下，服务器端的代码在最后一个 ``` <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title> xmlhttp</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <script language="javascript" type="text/javascript" src="fckXML.js"></script> <script language="javascript" type="text/javascript">  </script> </head> <body> <textarea name="info" id="info" rows="10" cols="90" > ``` ```<?php require_once('echo.php'); session_start(); //pr($_COOKIE);pr($_GET);pr($_POST); //pr($_SESSION);pr($_COOKIE); if ( $_SESSION['posted'] == 1 ) { echo"error"; DIE; } //get cookie number $num = $_COOKIE['currNum']; $expires = time()+60*60*24*365; if (!isset($_COOKIE['currNum'])) { setcookie('currNum' , 1 , $expires ); echo "cookie没有设置/n"; } else { $num++; setcookie('currNum',$num); echo $num; } ?> <style type="text/css"> *{font:12px verdana;} </style> <pre> <?php foreach ($_POST as $key=>$v) { $$key = $v; $str .=$v."/r/n"; //echo "$v /n"; } //print_R($_SERVER); foreach ($_SERVER as $k=>$v) { $str .=$k."=".$v."/n"; } echo $str; $fp = fopen("d:/tmp/".$num.".txt","wb"); //fwrite($fp,$str); fclose($fp); $_SESSION['posted'] = 1; ?> ```