我用 mysql 制作了一个迷你项目脚本,这真的很完美!您不需要 HTTPS 来隐藏 ajax 文件。尝试这个。这 100% 有效!
MYSQL代码:
SET FOREIGN_KEY_CHECKS=0;
DROP TABLE IF EXISTS `ajax_sessions`;
CREATE TABLE `ajax_sessions` (
`id` int(11) NOT NULL AUTO_INCREMENT,
`sid` text NOT NULL,
`sip` varchar(18) NOT NULL,
`open` int(1) NOT NULL,
PRIMARY KEY (`id`)
)
ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8;
创建名为 security.php 的文件并将其包含到主页中,如 index.php 插入并保存此代码
// INCLUDE YOUR MYSQL CONNECT FILE
require '/engine/config/mysql.php';
// SESSION IP ADDRESS
$sip = $_SERVER['REMOTE_ADDR'];
// COUNT IF TABLE FOR THIS IP ADDRESS EXISTS
$count = mysql_fetch_array(mysql_query("SELECT COUNT(*) FROM ajax_sessions WHERE sip = '".$sip."'"));
// COUNT VAR
$count = $count['COUNT(*)'];
// GENERATE RANDOM SESSION ID
$sid = substr(str_shuffle("_-0123456789-_-abcdefghijklmnopqrstuvwxyz-_-ABCDEFGHIJKLMNOPQRSTUVWXYZ-_"), 0, 50);
// YOUR AJAX / XMLHTTP / (LOAD) CALL
echo '
<script>
$("button").click(function() {
$(".container").load("/ajax/request.php?sid='.$sid.'");
});
// CHEC IF CODE WORKS
console.log("Ajax - Session control is activated.");
</script>';
// IF TABLE FOR THIS IP ADDRESS NOT EXISTS INSERT IP,SESSION AND OPEN SESSION.
if($count<1) {mysql_query("INSERT INTO ajax_sessions (sid,sip,open) VALUES ('".$sid."','".$sip."','1')");
} else {
// IF THIS IP ALREADY EXISTS INTO TABLE JUST UPDATE IT AND INSERT SESSION ID.
mysql_query("UPDATE ajax_sessions SET sid = '".$sid."', sip = '".$sip."', open = '1'");
}
将此 PHP 代码放入 AJAX 文件
// IF GET sid ( SESSION ID )
if($_GET) {
// CHECK IF SESSION ID IS SET
if(isset($_GET['sid']) && $_GET['sid'] == $_GET['sid'] && !empty($_GET['sid'])) {
// SESSION REMOTE IP ADDRESS
$sip = $_SERVER['REMOTE_ADDR'];
// GET SESSION ID WE GOT
$sid = $_GET['sid'];
// COUNT IF THIS SESSION EXISTS IN MYSQL BASE
$fetch = mysql_fetch_array(mysql_query("SELECT COUNT(*) FROM ajax_sessions WHERE sid = '".$sid."' AND sip = '".$sip."' AND open = '1'"));
// COUNT SESSION
if($fetch['COUNT(*)'] == 1) {
// IF SESSION EXISTS CATCH IP ADDRESS AND CLEAR SESSION ID FOR THIS IP AND CLOSE IT, BUT NOT REMOVE
mysql_query("UPDATE ajax_sessions SET sid = NULL, sip = '".$sip."', open = '0'");
} else {
// DIE IF SESSION NOT EXISTS AND DO NOT SHOW CODE
die;
}
// IF IT WORKS OPEN JS CONSOLE LOG WITH F12 FOR GOOGLE CHROME
echo '<script>console.log("Session unseted !")</script>';
}
// AJAX POST CONTENT. IF POST
} else if($_POST) {
echo 'Call request';
}
我知道这很难理解,但它确实有效,我正在使用它。