Only allow webpage to be viewed via link click

Is there a way to only let a webpage be viewed if the link pointing to it is pressed. I am sending emails to members of my organization with links that attach values to the URL so I can use phps $_GET to figure out who they are on the webpage and 开发者_如何学Goupdate appropriately. What I am worried about is individuals changing the values of the link and changing other members data. If there is a better method for doing this, I am all ears. Using a log in system is not an option.

---

Not exactly, no.

What you could do is include some token that you keep associated with a particular user id and is very difficult to guess, and include that in the link as well - then, when you get a GET request, you check to make sure the token matches the one you know is correct for that userid. (You'd store the "correct" tokens locally in a database when sending out the emails.)

For instance, you might have...

/modify_info_script?user_id=123&token=aSDqWEqwejk2123salskq

And then you'd have a database table or some other storage that has...

user_id          token
----------------------
...              ...
122              klqwkejajwie8u8213nak
123              aSDqWEqwejk2123salskq
...              ...

and thus if someone tried to change the user_id in the URL, the token wouldn't match and you could reject their request. For instance, this would get rejected...

/modify_info_script?user_id=122&token=aSDqWEqwejk2123salskq

since the right token for 122 would be klqwkejajwie8u8213nak, not aSDqWEqwejk2123salskq.

This is probably the best option if using a login system isn't an option. However, you should really make sure that using a login system isn't an option at all, because user data really should be protected by a login.

---

This is really not the proper way to secure your site.

However, the simple fix for you is to check the "referer" header and make sure it's not blank. If it's not blank, then it came from a click (or they spoofed it, which is why this isn't secure).

The real way to protect data is to implement a login system with a set of permissions.

---

To check, if someone came from a link, see $_SERVER['HTTP_REFERER'].

To protect the application against link manipulation, you can combine it with a secret passphrase (only internally, the passphrase must not be known to anyone) and use md5() on the result. Attach the MD5 to the url. If anyone manipulates the url, you will know because the MD5 of "the url plus your passphrase minus the MD5" will be different.

---

Quite a lot password reset systems work like this so you could say it's reasonably safe provided you use long enough random token. Something like 32 chars should be fine.

Just providing the token should be enough since you don't need the user ID to check it against issued tokens in database.

/modify_info_script?token=aSDqWEqwejk2123salskqfilltill32chars

The other alternative is to have login system where use has to type in their credentials in order to change information.

Also if you really fear that someone might try to guess it, just timeout/ban users after 3 wrong token attempts. No one should be trying to type them in by hand anyway.