如何防止“手动执行”外部 PHP 脚本
简而言之，我在整个客户网站上使用外部 PHP 脚本来实现各种目的，例如获取搜索结果、更新内容等。
我将这些脚本保存在一个目录中：
www.domain.com/scripts/scriptname01.php
www.domain.com/scripts/scriptname02.php
www.domain.com/scripts/scriptname03.php
等等。
我通常使用 jQuery AJAX 调用来执行它们。
我想做的是找到一段代码，它将（从内部）检测这些脚本是通过 AJAX 从文件中执行还是由用户通过 URL 手动执行。
这可能吗？
我已经到处搜索并尝试了各种方法来处理 $_SERVER[] 数组，但仍然没有成功。
In simplest terms, I utilize external PHP scripts throughout my client's website for various purposes such as getting search results, updating content, etc.
I keep these scripts in a directory:
www.domain.com/scripts/scriptname01.php
www.domain.com/scripts/scriptname02.php
www.domain.com/scripts/scriptname03.php
etc..
I usually execute them using jQuery AJAX calls.
What I'm trying to do is find is a piece of code that will detect (from within) whether these scripts are being executed from a file via AJAX or MANUALLY via URL by the user.
IS THIS POSSIBLE??
I've have searched absolutely everywhere and tried various methods to do with the $_SERVER[] array but still no success.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
不，不是 100% 可靠。您无法阻止客户端模拟 Ajax 调用。
不过，您可以测试一些标头，即
X-Requested-With。它们会阻止不熟练的用户直接调用您的 Ajax URL。请参阅检测 Ajax 调用 URLNo, not with 100% reliability. There's nothing you can do to stop the client from simulating an Ajax call.
There are some headers you can test for, though, namely
X-Requested-With. They would prevent an unsophisticated user from calling your Ajax URLs directly. See Detect Ajax calling URL大多数 AJAX 框架都会发送
X-Requested-With:标头。假设您在 Apache 上运行，您可以使用 apache_request_headers() 函数来检索标头并检查/解析它。即便如此，也没有什么可以阻止某人手动设置此标头 - 没有真正的 100% 万无一失的方法来检测此问题，但检查此标头可能是您所能得到的最接近的结果。
根据您需要保护的内容和原因，您可能会考虑需要某种形式的身份验证，和/或使用唯一的哈希/PHP 会话，但这仍然可以由任何了解一点 Javascript 的人进行逆向工程。
作为您可以验证的事情的一个想法，如果您在为您请求提供服务之前验证所有这些内容，它将提供一定程度的确定性（尽管不是很多，如果有人故意试图破坏您的系统，则没有）：
X-Requested-With: header 已设置，值为明智的User-Agent:标头是否与启动会话的标头相同。检查的内容越多，攻击者就越有可能在得到正确答案之前感到无聊并放弃。同样，服务每个请求所需的时间越长/更多的系统资源......
Most AJAX frameworks will send an
X-Requested-With:header. Assuming you are running on Apache, you can use the apache_request_headers() function to retrieve the headers and check for it/parse it.Even so, there is nothing preventing someone from manually setting this header - there is no real 100% foolproof way to detect this, but checking for this header is probably about as close as you will get.
Depending on what you need to protect and why, you might consider requiring some form of authentication, and/or using a unique hash/PHP sessions, but this can still be reverse engineered by anyone who knows a bit about Javascript.
As an idea of things that you can verify, if you verify all of these before servicing you request it will afford a degree of certainty (although not much, none if someone is deliberately trying to cirumvent your system):
X-Requested-With:header is set and the value is sensibleUser-Agent:header is the same as the one that started the sessionThe more things you check, the more chance an attacker will get bored and give up before they get it right. Equally, the longer/more system resources it will take to service each request...
如果用户知道您的请求地址，则没有 100% 可靠的方法可以阻止他调用您的脚本。
这就是为什么您必须验证对脚本的每个请求。如果您的脚本仅由经过身份验证的用户调用，请在脚本中再次检查身份验证。像对待传入的用户输入一样对待它 - 验证和清理所有内容。
编辑时：对于用户可以通过 URL 访问的任何脚本都可以这样说。例如，考虑
profile.php?userid=3There is no 100% reliable way to prevent a user, if he knows the address of your request, from invoking your script.
This is why you have to authenticate every request to your script. If your script is only to be called by authenticated users, check for the authentication again in your script. Treat it as you will treat incoming user input - validate and sanitize everything.
On Edit: The same could be said for any script which the user can access through the URL. For example, consider
profile.php?userid=3