mysql - prevent Posting Data From Different Domain PHP -

i have form in php page. in page, opening window popup. in popup there fields. fill form , submit it. after submitting form send mail user. form user can give reference of website friend sending mail him. unfortunately hacked website , uses php script sending mails. so, want restrict access of php script outside server. should restrict access. have tried option did not success.

there 2 ways can mitigate this, totally stopping not possible.

use http referer:

$referer = parse_url($_server['http_referer']); $alloweddomain = 'yourdomain.com';  if ($referer['host'] == $alloweddomain){      //process mail script here. } 

note can not trust http_referer value. can spoofed.

use tokens:

generate random token , put within form post like:

if (!isset($_post['submit'])){     $_session['random_code'] = rand(0, 1000000); }else{     if ($_post['random_code'] == $_session['random_code']){         //process mail script here          //reissue session code         $_session['random_code'] = rand(0, 1000000);     } } <input type='hidden' name="random_code" value="<?php echo $_session['random_code'];?>"> 

save random code in session. , when form submitted, match submitted random_code value code saved in session. if both same process mail script.

in way, attacker has first open page, random code , submit form. not stop attack, slow down process.