国产av日韩一区二区三区精品,成人性爱视频在线观看,国产,欧美,日韩,一区,www.成色av久久成人,2222eeee成人天堂

Table of Contents
Generate and Store Anti-CSRF Tokens
Validate the Token on Form Submission
Don’t Forget AJAX Requests and APIs
Bonus Tips: SameSite Cookies and HTTP-Only Forms
Home Backend Development PHP Tutorial How do I prevent cross-site request forgery (CSRF) attacks in PHP?

How do I prevent cross-site request forgery (CSRF) attacks in PHP?

Jun 28, 2025 am 02:25 AM
php csrf

To prevent CSRF attacks in PHP, implement anti-CSRF tokens. 1) Generate and store secure tokens using random_bytes() or bin2hex(random_bytes(32)), save them in $_SESSION, and include them in forms as hidden inputs. 2) Validate tokens on submission by strictly comparing the POST token with the session-stored one; reject mismatched requests with a 403 error. 3) Protect AJAX/API requests by including the token in headers or body, often retrieved from a meta tag. 4) Use htmlspecialchars() when outputting tokens to prevent XSS leaks. 5) Regenerate tokens after critical actions like login. 6) Set SameSite=Strict/Lax for session cookies and avoid GET for state changes. 7) Re-authenticate users for sensitive actions. These steps ensure comprehensive CSRF protection across all request types while maintaining security integrity.

How do I prevent cross-site request forgery (CSRF) attacks in PHP?

To prevent CSRF attacks in PHP, you need to implement a solid anti-CSRF strategy—mainly by using tokens. The idea is simple: every state-changing request (like form submissions) should include a unique, unpredictable token that only the legitimate user knows. Without this token, the server shouldn’t process the request.

Here’s how to actually do it well in practice.


Generate and Store Anti-CSRF Tokens

Every time you display a form that performs an action (like submitting settings or making a purchase), generate a secure token and store it somewhere safe on the server side—like in the session.

  • Use random_bytes() or bin2hex(random_bytes(32)) to create a strong token.
  • Save it in $_SESSION so you can compare it later when the form is submitted.

For example:

if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(50));
}

Then in your form:

<input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">

This way, each form submission includes a token that the attacker can't guess or reproduce.


Validate the Token on Form Submission

When the form is submitted, check if the token in the POST data matches what’s stored in the session.

  • Always check for the presence of the token.
  • Compare it strictly (===) to avoid type-juggling issues.
  • If it doesn’t match, reject the request with a 403 error or similar.

Example code:

if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    http_response_code(403);
    die('Invalid CSRF token.');
}

A small but important detail: always use htmlspecialchars() when outputting the token into HTML to prevent XSS from leaking the token.

Also, don’t forget to rotate or regenerate the token after critical actions like login or password change.


Don’t Forget AJAX Requests and APIs

If your site uses JavaScript to submit forms or make API calls, those requests also need CSRF protection.

  • Include the CSRF token in the headers or body of the AJAX request.
  • You can store the token in a meta tag or inline script and read it from there when making the call.

For example, set a meta tag in your HTML head:

<meta name="csrf-token" content="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">

Then in your JS:

fetch('/update-profile', {
    method: 'POST',
    headers: {
        'X-CSRF-Token': document.querySelector('meta[name="csrf-token"]').content
    },
    body: new URLSearchParams({ name: 'John Doe' })
});

On the backend, look for the token in the X-CSRF-Token header and validate it just like with regular forms.

One thing to note: if you're building a single-page app (SPA) or mobile app that talks to your PHP backend, consider using same-site cookies and CSRF tokens together for better protection.


Bonus Tips: SameSite Cookies and HTTP-Only Forms

Even with tokens, there are extra steps you can take:

  • Set SameSite=Strict or Lax on your session cookie to reduce cross-origin requests.
  • Make sure your forms only accept POST requests where needed—don’t allow GET-based state changes.
  • For sensitive operations (like deleting an account), re-authentication helps add another layer.

These aren’t replacements for CSRF tokens, but they work well alongside them.


That’s basically it. CSRF protection in PHP boils down to generating good tokens, validating them properly, and making sure they’re included in all relevant requests. It’s not overly complex, but easy to mess up if you skip even one step.

The above is the detailed content of How do I prevent cross-site request forgery (CSRF) attacks in PHP?. For more information, please follow other related articles on the PHP Chinese website!

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undress AI Tool

Undress AI Tool

Undress images for free

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

How to upgrade PHP version? How to upgrade PHP version? Jun 27, 2025 am 02:14 AM

Upgrading the PHP version is actually not difficult, but the key lies in the operation steps and precautions. The following are the specific methods: 1. Confirm the current PHP version and running environment, use the command line or phpinfo.php file to view; 2. Select the suitable new version and install it. It is recommended to install it with 8.2 or 8.1. Linux users use package manager, and macOS users use Homebrew; 3. Migrate configuration files and extensions, update php.ini and install necessary extensions; 4. Test whether the website is running normally, check the error log to ensure that there is no compatibility problem. Follow these steps and you can successfully complete the upgrade in most situations.

How do I prevent cross-site request forgery (CSRF) attacks in PHP? How do I prevent cross-site request forgery (CSRF) attacks in PHP? Jun 28, 2025 am 02:25 AM

TopreventCSRFattacksinPHP,implementanti-CSRFtokens.1)Generateandstoresecuretokensusingrandom_bytes()orbin2hex(random_bytes(32)),savethemin$_SESSION,andincludetheminformsashiddeninputs.2)ValidatetokensonsubmissionbystrictlycomparingthePOSTtokenwiththe

PHP beginner guide: Detailed explanation of local environment configuration PHP beginner guide: Detailed explanation of local environment configuration Jun 27, 2025 am 02:09 AM

To set up a PHP development environment, you need to select the appropriate tools and install the configuration correctly. ①The most basic PHP local environment requires three components: the web server (Apache or Nginx), the PHP itself and the database (such as MySQL/MariaDB); ② It is recommended that beginners use integration packages such as XAMPP or MAMP, which simplify the installation process. XAMPP is suitable for Windows and macOS. After installation, the project files are placed in the htdocs directory and accessed through localhost; ③MAMP is suitable for Mac users and supports convenient switching of PHP versions, but the free version has limited functions; ④ Advanced users can manually install them by Homebrew, in macOS/Linux systems

How to combine two php arrays unique values? How to combine two php arrays unique values? Jul 02, 2025 pm 05:18 PM

To merge two PHP arrays and keep unique values, there are two main methods. 1. For index arrays or only deduplication, use array_merge and array_unique combinations: first merge array_merge($array1,$array2) and then use array_unique() to deduplicate them to finally get a new array containing all unique values; 2. For associative arrays and want to retain key-value pairs in the first array, use the operator: $result=$array1 $array2, which will ensure that the keys in the first array will not be overwritten by the second array. These two methods are applicable to different scenarios, depending on whether the key name is retained or only the focus is on

How to use php exit function? How to use php exit function? Jul 03, 2025 am 02:15 AM

exit() is a function in PHP that is used to terminate script execution immediately. Common uses include: 1. Terminate the script in advance when an exception is detected, such as the file does not exist or verification fails; 2. Output intermediate results during debugging and stop execution; 3. Call exit() after redirecting in conjunction with header() to prevent subsequent code execution; In addition, exit() can accept string parameters as output content or integers as status code, and its alias is die().

Applying Semantic Structure with article, section, and aside in HTML Applying Semantic Structure with article, section, and aside in HTML Jul 05, 2025 am 02:03 AM

The rational use of semantic tags in HTML can improve page structure clarity, accessibility and SEO effects. 1. Used for independent content blocks, such as blog posts or comments, it must be self-contained; 2. Used for classification related content, usually including titles, and is suitable for different modules of the page; 3. Used for auxiliary information related to the main content but not core, such as sidebar recommendations or author profiles. In actual development, labels should be combined and other, avoid excessive nesting, keep the structure simple, and verify the rationality of the structure through developer tools.

How do I access session data in PHP? How do I access session data in PHP? Jun 30, 2025 am 01:33 AM

To access session data in PHP, you must first start the session and then operate through the $_SESSION hyperglobal array. 1. The session must be started using session_start(), and the function must be called before any output; 2. When accessing session data, check whether the key exists. You can use isset($_SESSION['key']) or array_key_exists('key',$_SESSION); 3. Set or update session variables only need to assign values ??to the $_SESSION array without manually saving; 4. Clear specific data with unset($_SESSION['key']), clear all data and set $_SESSION to an empty array.

What are recursive functions in PHP? What are recursive functions in PHP? Jun 29, 2025 am 02:02 AM

Recursive functions refer to self-call functions in PHP. The core elements are 1. Defining the termination conditions (base examples), 2. Decomposing the problem and calling itself recursively (recursive examples). It is suitable for dealing with hierarchical structures, disassembling duplicate subproblems, or improving code readability, such as calculating factorials, traversing directories, etc. However, it is necessary to pay attention to the risks of memory consumption and stack overflow. When writing, the exit conditions should be clarified, the basic examples should be gradually approached, the redundant parameters should be avoided, and small inputs should be tested. For example, when scanning a directory, the function encounters a subdirectory and calls itself recursively until all levels are traversed.

See all articles