0
美好的一天大师。我正在寻求帮助，以增加我使用的旧的告诉朋友PHP脚本的垃圾邮件安全性。上周它是一个垃圾邮件机器人的受害者，它在不到一分钟的时间内使用它60次，使服务器过载。我的问题是，我怎样才能以最简单或最简单的方式修改它，可能会保存知识产权或使用cookie，不确定，以便同一用户在一分钟内不能使用它超过3次，例如如果你有更好的建议，这将是更受欢迎;]增加告诉朋友PHP脚本的安全性
这是加载脚本的HTML网页（HTML是过时的，我一直在努力）
<html>
<head>
<title>Tell a Friend</title>
<meta name="robots" content="noindex, nofollow" />
<script language="javascript">
function reset() {
document.tellafriend.name.value="";
document.tellafriend.email.value="";
document.tellafriend.fmail1.value="";
document.tellafriend.fmail2.value="";
document.tellafriend.fmail3.value="";
}
function validate() {
if (document.tellafriend.fmail1.value.length==0) {
alert("Oops! you'll need to enter a friend's email address");
return false;
}
if (document.tellafriend.email.value.length==0) {
alert("Oops! you forget to enter your email address");
return false;
}
if (document.tellafriend.name.value.length==0) {
alert("Oops! you forgot to enter your name");
return false;
}
document.tellafriend.submit()
return true;
}
</script>
</head>
<body onLoad="reset()">
<table>
<tr>
<td>
<span>Complete the details below to send this link to a friend:</span>
<? $refurl = $_SERVER['HTTP_REFERER']; ?>
<span><? print $refurl;?></span>
<form name="tellafriend" action="tellafriend.php" method="post" onSubmit="return checkfields()">
<table>
<tr>
<td> Your name*:</td>
<td>
<input name="name" size="30" maxlength="45">
</td>
</tr>
<tr>
<td>Your email*:</td>
<td>
<input name="email" size="30" maxlength="45">
</td>
</tr>
<tr>
<td colspan="2">
<p align="center">Enter your friend's email addresses:</p>
</td>
</tr>
<tr>
<td>Email 1*:</td>
<td>
<input name="fmail1" class="bordesolid1" size="30" maxlength="50">
</td>
</tr>
<tr>
<td>Email 2*:</td>
<td>
<input name="fmail2" size="30" maxlength="50">
</td>
</tr>
<tr>
<td>Email 3*:</td>
<td>
<input name="fmail3" size="30" maxlength="50">
</td>
</tr>
<tr>
<td colspan="2">
<p align="center">
<span>This message will contain your name & email address.</span><br>
<input onclick="validate();" type="button" value="click once to send">
<input type=hidden name=refurl value="<? print $refurl;?>">
</td>
</tr>
</table>
</form>
</td>
</tr>
</table>
</body>
</html>
这是PHP脚本（tellafriend.php）：
<?php
if(count($_POST)) {
foreach(array('fmail1','fmail2','fmail3','email','name') as $key) $_POST[$key] = strip_tags($_POST[$key]);
if(!is_secure($_POST)) {
die("Peace People! Stop Spamming!");
}
$emailto = "[email protected]";
$esubject = "Recommendation form submission";
$emailtext = "$_POST[name] has used your recommendation form using an email address of $_POST[email].
The people the recommendation has been submitted to are:
$_POST[fmail1]
$_POST[fmail2]
$_POST[fmail3]
The page recommended:
$_POST[refurl]";
@mail("$emailto", $esubject, $emailtext, "From: $_POST[email]");
$thankyoupage = "thankyou.htm";
$tsubject = "A web page recommendation from $_POST[name]";
$ttext = "Hi, $_POST[name], whose email address is $_POST[email] thought you may be interested in this web page.
$_POST[refurl];
@mail("$_POST[fmail1],$_POST[fmail2],$_POST[fmail3]", $tsubject, $ttext, "FROM: $_POST[email]");
header("Location: $thankyoupage");
exit;
}
function is_secure($ar) {
$reg = "/(Content-Type|Bcc|MIME-Version|Content-Transfer-Encoding)/i";
if(!is_array($ar)) {
return preg_match($reg,$ar);
}
$incoming = array_values_recursive($ar);
foreach($incoming as $k=>$v) if(preg_match($reg,$v)) return false;
return true;
}
function array_values_recursive($array) {
$arrayValues = array();
foreach ($array as $key=>$value) {
if (is_scalar($value) || is_resource($value)) {
$arrayValues[] = $value;
$arrayValues[] = $key;
}
elseif (is_array($value)) {
$arrayValues[] = $key;
$arrayValues = array_merge($arrayValues, array_values_recursive($value));
}
}
return $arrayValues;
}
?>
万分感谢您的帮助。如果有人可以推荐我的另一个（简单）安全性更高的安全产品，那也会很棒。
你应该张贴的问题在这里：[代码评论] [1]和阅读[PHP安全] [2]和[PHP安全最佳做法] [3] [1]：HTTP：//代码审查.stackexchange.com/ [2]：http://stackoverflow.com/questions/2119083/php-tutorial-that-is-security-accuracy-and-maintainability-conscious?lq=1 [3]：http： //stackoverflow.com/questions/3/php-security-best-practices – pablofiumara
你最好使用社交分享工具，这已经是垃圾邮件证明。 http://www.addthis.com是一个受欢迎的网站。 – cgTag
没有简单的答案。 Cookie和会话很容易绕过，而IP封锁可能会导致许多人共享相同的公共IP的业务出现问题。您可以添加验证码，但合法用户会感到恼火。 –