ThinkPHP3.2 supports form tokens

Prevent multiple submission of
Insert picture description here
config.php for the same request

    'TOKEN_ON' => true, // 是否开启令牌验证 默认关闭
    'TOKEN_NAME' => '__hash__', // 令牌验证的表单隐藏字段名称，默认为__hash__
    'TOKEN_TYPE' => 'md5', //令牌哈希验证规则 默认为MD5
    'TOKEN_RESET' => true, //令牌验证出错后是否重置令牌 默认为true在这里插入代码片

tags.php

<?php
return array(
    'view_filter' => array(
        'Behavior\TokenBuildBehavior', // 表单令牌
    ),
);

TestController controller code


    public function tokenTest(){
    
    
        if ($_POST){
    
    
            $User = M(); // 实例化User对象
            // 手动进行令牌验证
            if(!$User->autoCheckToken($_POST)){
    
    
                echo "表单验证失败";exit();
            }
            print_r($_POST);
        }
        $this->display();

    }

tokenTest.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>
<form action="{:U('tokenTest')}" method="post">
    {
    
    __TOKEN__}
    <input type="text" name="username" value="">
    <input type="submit" name="dosubmit" value="dosubmit">
</form>
</body>
</html>

principle


    // 自动表单令牌验证
    // TODO  ajax无刷新多次提交暂不能满足
    public function autoCheckToken($data) {
    
    
        // 支持使用token(false) 关闭令牌验证
        if(isset($this->options['token']) && !$this->options['token']) return true;
        if(C('TOKEN_ON')){
    
    
            $name   = C('TOKEN_NAME', null, '__hash__');
            if(!isset($data[$name]) || !isset($_SESSION[$name])) {
    
     // 令牌数据无效
                return false;
            }

            // 令牌验证
            list($key,$value)  =  explode('_',$data[$name]);
            if(isset($_SESSION[$name][$key]) && $value && $_SESSION[$name][$key] === $value) {
    
     // 防止重复提交
                unset($_SESSION[$name][$key]); // 验证完成销毁session
                return true;
            }
            // 开启TOKEN重置
            if(C('TOKEN_RESET')) unset($_SESSION[$name][$key]);
            return false;
        }
        return true;
    }

ThinkPHP3.2 supports form tokens

Guess you like