I have a question about stopping spoofed form submissions. How about if by using the $_SERVER['HTTP_REFERER']
I only allow submissions to my forms coming from my website? Would that help?! Thanks!
I have a question about stopping spoofed form submissions. How about if by using the $_SERVER['HTTP_REFERER']
I only allow submissions to my forms coming from my website? Would that help?! Thanks!
It would help, and it's fairly easy thing to add but it wont stop a targeted attack, after all you can spoof a HTTP_REFERER
header.
One thing to keep in mind is that a client is not required to send a HTTP_REFERER
, so if the header is missing you might want to allow submissions anyway. If this is not possible, then checking HTTP_REFERER
wont help you.
Run a search for CAPTCHA "Completely Automated Public Turing test to tell Computers and Humans Apart", this is what you're really looking for.