如何确保数据库中的产品ID不被篡改
我有一个小型 PHP/MySQL 购物车系统，用户可以在其中添加产品、结帐和付款。
这些产品都有 ID，这样当用户结账时，
我可以获得该产品的属性（价格、重量、供应商的帐户 ID 等）。
现在，某人打开 Firebug 真的很容易，
猜测另一个产品 ID，更改它，然后结账。
防止这种情况的最佳方法是什么？
如果重要的话，商店和结账系统位于两个不同的域。
我可以使用诸如唯一令牌之类的东西
但如果多个客户可以同时使用购物车，那该怎么办呢？
编辑：哇，输入得太快了，遗漏了一些重要的细节。购物车当前表示为存储在 PHP 会话中的 JSON。所有产品都有一个 account_id，将它们与供应商的帐户关联起来。
如果用户更改了产品 ID 并且碰巧在另一个供应商的帐户下获得了产品（本质上是从不同公司的商店购买了另一家公司的产品），就会出现问题，这是不可取的。感谢您到目前为止的回答。
I have this small PHP/MySQL cart system that users add products to, checkout, and pay.
These products all have IDs on them so that when the user checks out,
I can get that product's attributes (price, weight, the vendor's account id, etc).
Right now it would be really easy for someone to open up Firebug,
guess another product ID, change it, and checkout.
What would be the best way to prevent this?
The store and the checkout system are on two different domains if that matters.
I could use something like a unique token
but how would that work if multiple customers could be using the cart at the same time?
EDIT: Wow, typed this too fast, left out some important details. The cart is currently represented as JSON that is being stored in a PHP session. All products have an account_id that associates them with a vendor's account.
The problem would occur if a user changed the product id and happened to get a product under another vendor's account (essentially purchasing another company's product from a different company's store) which would be undesirable. Thank you for the answers so far.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
使用服务器端会话来存储购物车详细信息。
每个会话都有一个唯一的 ID，存储在 cookie 中。所有详细信息（所选项目、金额等）都与此 sessionId 相关联。
根据定义，您不希望不同的客户使用同一个购物车。相反，每个客户都使用自己单独的购物车副本。
如果您需要与某些外部服务“共享”sessionId，请计算一个单独的唯一密钥并与第三方服务（=您的情况下的结帐服务）共享此密钥。
这确保您在与第三方通信时可以唯一地识别您的客户，而第三方不知道您如何识别您的客户或与您这边的客户通信。 （要记住的重要一点是，sessionId 是一个共享秘密，其他人不应该知道它）。
Use a server side session to store the cart details.
Every session gets a unique ID, stored in a cookie. All details (selected items, amount, etc) are tied to this sessionId.
By definition, you do not want different customers to use the same cart. Instead, every custommer uses their own separate copy of the cart.
If you need to 'share' the sessionId with some external service, instead calculate a separate unique key and share this key with the third party service (=checkout service in your case).
This ensures that you can uniquely identify your customer in communications with the thirds party, without the third party knowing anything about how you identify or communicate with your customer on your side of the fence. (the important thing to remember is, a sessionId is a shared secret, nobody else should ever know about it).
如果您有权访问购物车系统，正确的方法是在运行付款之前让它重复 ID 查找和成本计算。这样，如果有人将 1.99 美元的一盒糖果换成 1999.99 美元的高清电视，他们将需要支付电视费用。
如果您无法访问购物车系统，或者您无法告诉它产品是什么及其成本。获取新的购物车系统。
附带说明：您永远不应该信任来自用户的数据。不需要建立对用户的信任。只需接受 ID 并在服务器上运行所有数字即可。
If you have access to the cart system, the proper way would be to have it duplicate the ID lookup and cost calculations before running the payment. That way, if someone DOES change from a $1.99 box of candy to a $1999.99 HDTV, they will get charged for the tv.
If you don't have access to your cart system, or you can't tell it what the products are and their cost. Get a new cart system.
As a side note: You should NEVER trust data that has come from the user. There should be no need to have to build in trusting the user. Just accept the IDs and run all the numbers on the server.
一种方法是使用哈希。当他们选择产品并呈现表单时，获取产品 ID 的哈希值并将其存储在产品 ID 旁边的隐藏字段中。当“结帐”发布发生时，获取发布的产品 ID 的哈希值，并将其与表单中发送的产品 ID 进行比较。如果它们不匹配，则产品 ID 已被篡改。我不熟悉 PHP，因此无法提供代码示例，但我已经在 ASP.NET 中使用了这种方法，而且它很有魅力。
希望这是有道理的！
One way to do this is to use a hash. When they select a product and the form is rendered, take a hash of the Product Id and store it in a hidden field alongside the Product Id. When the 'checkout' post occurs, take a hash of the Product Id that is posted and compare it to the one that was sent out in the form. If they don't match, then the Product Id has been tampered with. I'm not familiar with PHP so can't provide a code sample but I've used this approach in ASP.NET and it works a charm.
Hope that makes some sense!
威胁是什么？如果客户端只有产品 ID，那么如果他们更改 ID，他们就会购买不同的产品，仅此而已。或者你的产品并不适合所有人？如果不是，您需要使用随机 ID，这样就不会被轻易猜到。
And what the threat is? If the client-side has only product IDs, then if they change the ID, they'd be buying different product, and that's all. Or your products are not available for all? If they aren't, you need to use random IDs so that they couldn't be easily guessed.
我认为你要做的就是加密/解密你的产品 ID 并使用它。
你可以使用base64_encode()和base64_decode()
希望这会有所帮助
I think what you have to do is encrypt/decrypt your product id and use it.
you can use base64_encode() and base64_decode()
Hope this will help