restrict access with a hidden input

Ive been struggling with this for a day or two. Not just the coding but explaining the situation precisely. I have a static form on a page, "download-registration.php" when you submit the form (validated CS and SS) it then takes you to "download-software.php" where you can well, download the software. I do not want "download-software.php" to be accessible from anywhere but "download-registration.php" and ONLY after you submit the form. This is the problem I was having with a session based restriction, you could go to "download-registration.php" and alter the url to get to the download page.

I think I ne开发者_如何转开发ed to create a variable (random 1, 65335)? insert that value into a hidden input on click and make sure it matches to a value on the "download-software.php" page?

How do I go about this? does it need to be done this way or is there a better way? Any help is much appreciated!

---

Make whatever you have that processes the form you want to force them to submit also add a variable to the session. Then check to see if that variable is set on the download page.

My guess is that with your earlier session-based approach you were setting something in the session when the form was loaded, but you need to do it when you process it instead if you want to make sure they submit it first.

Edit:

display_form.php:

// ... display the form, you don't need to set any $_SESSION here ...

process_form.php

session_start();

// ... process the form ...

$_SESSION['form_processed'] = 1

// ... redirect to download page ...

download_page.php

session_start();

if($_SESSION['form_processed'] != 1) {
    // user never submitted form, reject them ...
} else {
    // user submitted the form, show them the download page
}

---

This is pretty common. You see this in large PHP projects like WordPress, CakePHP, etc.

There are many ways, essentially you just need to create a validity token that is generated and passed from your registration form. You can then clear this token on your software page based on your logic.

You can use a random number, md5(), uniqid() or whatever. There's also an nonce library out there.