防止直接 url 访问 php 文件
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/33999475/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
prevent direct url access to php file
提问by It Assistors
I have a php file say "check.php"in my website and it is executed when a form is submitted.
我的网站中有一个 php 文件，上面写着“check.php”，它在提交表单时执行。
say my website is "myweb.com"and the php file is in a directory "PHP"
说我的网站是“myweb.com”，php 文件在目录“PHP”中
I want to prevent direct url access to the "check.php" file i.e. if anyone types the url "myweb.com/PHP/check.php" ,then the php file should not be executed and it should return a error message instead.
我想阻止对“check.php”文件的直接 url 访问，即如果有人输入 url“ myweb.com/PHP/check.php”，则不应执行 php 文件，而是应返回错误消息。
I tried to prevent the access by setting a rule in .htaccess ,but it blocks the php even when I try to submit the form.
我试图通过在 .htaccess 中设置规则来阻止访问，但即使我尝试提交表单，它也会阻止 php。
.htaccess rule :
.htaccess 规则：
RewriteEngine on
RewriteCond %{THE_REQUEST} \.php[\ /?].*HTTP/
(.*)\.php$ /index.html [L]
Is there any possible way to do it ?
有什么可能的方法吗？
回答by RamRaider
You can do it with PHP
你可以用 PHP 做到
<?php
/* at the top of 'check.php' */
if ( $_SERVER['REQUEST_METHOD']=='GET' && realpath(__FILE__) == realpath( $_SERVER['SCRIPT_FILENAME'] ) ) {
/*
Up to you which header to send, some prefer 404 even if
the files does exist for security
*/
header( 'HTTP/1.0 403 Forbidden', TRUE, 403 );
/* choose the appropriate page to redirect users */
die( header( 'location: /error.php' ) );
}
?>
回答by Westly Tanbri
Put this code at the top of check.php:
将此代码放在 check.php 的顶部：
if(!isset($_SERVER['HTTP_REFERER'])){
// redirect them to your desired location
header('location:../index.php');
exit;
}
If the user access check.php by type the URL directly, it will redirect them to your desired location.
如果用户通过直接键入 URL 访问 check.php，它会将它们重定向到您想要的位置。
回答by starkeen
Try this in Root/.htaccess :
在 Root/.htaccess 中试试这个：
RewriteEngine on
RewriteCond %{REQUEST_METHOD} !^POST$
RewriteRule ^php/check.php$ - [NC,R=404,L]
This will return 404 not found if check.php is not accessed by form post method.
如果表单 post 方法未访问 check.php，这将返回 404 not found。
回答by Toskan
this is what google uses in their php examples
这是谷歌在他们的 php 示例中使用的
if (php_sapi_name() != 'cli') {
throw new \Exception('This application must be run on the command line.');
}
回答by Martin Koch
I tried the selected answer but i ran into some issues implementing it, specially if i wanted to return values from functions inside the PHP file using GET with Ajax.
我尝试了选定的答案，但在实现它时遇到了一些问题，特别是如果我想使用 GET 和 Ajax 从 PHP 文件中的函数返回值。
After doing quite an extensive research on other solutions (and a little testing of my own), i came up with the following code:
在对其他解决方案进行了相当广泛的研究（以及我自己的一些测试）之后，我想出了以下代码：
<?php
$currentPage = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? "https" : "http") . "://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";
if ($_SERVER['REQUEST_METHOD'] == "GET" && strcmp(basename($currentPage), basename(__FILE__)) == 0)
{
http_response_code(404);
include('myCustom404.php'); // provide your own 404 error page
die(); /* remove this if you want to execute the rest of
the code inside the file before redirecting. */
}
?>
I found that the code above worked as i wanted and i don't think it would have any problems with multiple browser like the other answer was pointed out to have. I also don't think it would have any security issues, but i could be wrong (please tell me if i am (and why)), i'm relatively new to web programming.
我发现上面的代码按我的意愿工作，我认为它不会像其他答案那样在多个浏览器中出现任何问题。我也不认为它会有任何安全问题，但我可能是错的（请告诉我我是否（以及为什么）），我对网络编程相对较新。
Just add that code on top of every file you would want to block direct URL access (before everything, even requires, includes and session_starts) and you are good to go.
只需将该代码添加到您想要阻止直接 URL 访问的每个文件的顶部（在一切之前，甚至需要，包括和 session_starts），您就可以开始了。
回答by Erik Thiart
if (basename($_SERVER['SCRIPT_FILENAME']) === 'common.php')
{
exit('This page may not be called directly!');
}
回答by icynets
Try this one too. Past in the top of check.php
也试试这个。过去在 check.php 的顶部
<?php debug_backtrace() || die ("<h2>Access Denied!</h2> This file is protected and not available to public."); ?>
An Access Denied will be presented when the file is access directly in the url
直接在 url 中访问文件时会出现 Access Denied
