PHP Security / Form Processing / ...

Spoofed HTTP Requests

HTTP 请求欺骗

A more powerful, although less convenient approach is to spoof an HTTP request. In the example form just discussed, where the user chooses a color, the resulting HTTP request looks like the following (assuming a choice of red):

HTTP 请求欺骗非常的强大，而且还很方便。在上面讨论到的那个让用户选择颜色示例中， 结果生成的 HTTP 请求看起来是这个样子的（假设用户选择了红色）：

The telnet utility can be used to perform some ad hoc testing. The following example makes a simple GET request for http://www.php.net/:

telnet 工具能够用来执行这个用途的测试。 下面的例子执行了一个对 http://www.php.net/ 的简单的 GET 请求：

Of course, you can write your own client instead of manually entering requests with telnet. The following example shows how to perform the same request using PHP:

当然了,你也可以写一个你自己的客户端来替代在 telnet 里手动的输入那些请求指令。 下面的例子给你展示了如何用 PHP 完成相同的请求：

Sending your own HTTP requests gives you complete flexibility, and this demonstrates why server-side data filtering is so essential. Without it, you have no assurances about any data that originates from any foreign source.

发送你自己的 HTTP 请求可以给你最大的适应性。 这也证明了为什么服务器端的数据过滤这么的重要。 如果不进行服务器端数据过滤，所有的从外部过来的数据都是不保险的。