Anti-URL code not exactly perfect yet...
I have been working on a code to eliminate the use of the URL to gain access to certain pages.
Basically there is a series of pages on site that have 4 password boxes per. Based on the answer you type in the pass box you will be taken to another page. The importance of this is the sequence, we don't want people seeing step 12 if they haven't been to step 5.
So I want to try to eliminate Joe posting the URLs to the 12 steps on his site and then Mary deciding she doesn't want to bother with step 5 skip to step 11.
If that makes sense.
Anyway I have this code so far:
PHP Code:
<?php
if(isset($_POST['id'])) {
$p = array(
array('RED', '/red/index.php'),
array('BLUE', '/blue/index.php'),
array('YELLOW', '/yellow/index.php'),
array('GREEN', '/green/index.php')
);
if(!isset($p[$_POST['id']])) header("Location: " . 'http://' . $_SERVER['HTTP_HOST'] . substr($_SERVER['REQUEST_URI'], 0, strrpos($_SERVER['REQUEST_URI'], '/')) . "/index.php");
if($_POST['pass'] === $p[$_POST['id']][0])
header('Location: http://' . $_SERVER['HTTP_HOST'] . $p[$_POST['id']][1] . '?pass=' . $_POST['pass']);
else
header("Location: " . 'http://' . $_SERVER['HTTP_HOST'] . substr($_SERVER['REQUEST_URI'], 0, strrpos($_SERVER['REQUEST_URI'], '/')) . '/cheater.php');
} else {
?>
And for each of the 4 pass boxes:
PHP Code:
<table>
<tr>
<td>
<font size= "4">Red Answer is RED</font>
<form action="<?=$PHP_SELF?>" method="post">
<input type="hidden" name="id" value="0"/>
<input type="password" name="pass"/>
<input type= "submit" value= "Red Answer!"/></form>
</td>
</tr>
</table></center>
So, obviously if you enter RED in the passbox, you will go to mysite.com/red/index.php and if you just type "mysite.com/red/index.php" into your URL you will go to the cheater.php page.
HOWEVER... if you type "mysite.com/red/index.php?pass=RED" into the URL you will go to the red/index.php page...
Is there something I can do to eliminate the ?pass=RED part of the posting in the URL? I don't care if it is needed, just don't want it to show up in the actual URL for Joe, to copy and put on his site.
I am still foggy on the Post/Get thingy, would that help?
<EDIT>
I forgot to mention, I have the "check" on the /red/index.php, again with the next 4 passboxes ready to go, as follows:
PHP Code:
<?php
if(!isset($_GET['pass']) || $_GET['pass'] !== "RED")
header('Location: http://' . $_SERVER['HTTP_HOST'] . substr($_SERVER['REQUEST_URI'], 0, strrpos($_SERVER['REQUEST_URI'], '/')) . '/cheater.php');
if(isset($_POST['id'])) {
$p = array(
array('RED', '/red/index.php'),
array('BLUE', '/blue/index.php'),
array('YELLOW', '/yellow/index.php'),
array('GREEN', '/green/index.php')
);
if(!isset($p[$_POST['id']])) header("Location: " . 'http://' . $_SERVER['HTTP_HOST'] . substr($_SERVER['REQUEST_URI'], 0, strrpos($_SERVER['REQUEST_URI'], '/')) . "/index.php");
if($_POST['pass'] === $p[$_POST['id']][0])
header('Location: http://' . $_SERVER['HTTP_HOST'] . $p[$_POST['id']][1] . '?pass=' . $_POST['pass']);
else
header("Location: " . 'http://' . $_SERVER['HTTP_HOST'] . substr($_SERVER['REQUEST_URI'], 0, strrpos($_SERVER['REQUEST_URI'], '/')) . '/cheater.php');
} else {
?>
