javascript - PHP 脚本无法收集调用 html 页面的文件名

Question

我试图让 mail.php 脚本识别调用该脚本的页面，并将用户返回到该页面，如果表单未验证、为空等。当我单击“提交”时，它会返回到该页面。只是 404。

<?php
/*
This first bit sets the email address that you want the form to be submitted to.
You will need to change this value to a valid email address that you can access.
*/
$webmaster_email = "email@email.com";

/*
This next bit loads the form field data into variables.
If you add a form field, you will need to add it here.
*/
$email_address = $_REQUEST['email'];
$comments = $_REQUEST['comment'];
$fname = $_REQUEST['first-name'];
$lname = $_REQUEST['last-name'];
$filename = debug_backtrace();
$page = $filename[0]['file'];

/*
The following function checks for email injection.
Specifically, it checks for carriage returns - typically used by spammers to inject a CC list.
*/
function isInjected($str) {
    $injections = array('(\n+)',
        '(\r+)',
        '(\t+)',
        '(%0A+)',
        '(%0D+)',
        '(%08+)',
        '(%09+)'
    );
    $inject = join('|', $injections);
    $inject = "/$inject/i";
    if(preg_match($inject,$str)) {
        return true;
    }
    else {
        return false;
    }
}

// If the user tries to access this script directly, redirect them to the feedback form,
if (!isset($_REQUEST['email_address'])) {
    header( "Location: $page" );
}

// If the form fields are empty, redirect to the error page.
elseif (empty($email_address) || empty($comments) || empty($fname)) {
    echo "<script type=\"text/javascript\">window.alert('Please fill in the required fields.');
    window.location.href = $page;</script>";
    exit;
}

// If email injection is detected, redirect to the error page.
elseif (isInjected($email_address)){
    echo "<script type=\"text/javascript\">window.alert('Please, Try Again.');
    window.location.href = $page;</script>";
    exit;
}

// If we passed all previous tests, send the email then redirect to the thank you page.
else {
    mail("$webmaster_email", "Feedback Form Results", $comments, "From: $email_address");
    echo "<script type=\"text/javascript\">window.alert('Thank You for contacting us!');
    window.location.href = $page;</script>";
    exit;
}
?>

Answer 1

不需要debug_backtrace()。要获取引用页面，您可以替换此内容:

$filename = debug_backtrace();
$page = $filename[0]['file'];

这样:

$page = $_SERVER['HTTP_REFERER'];

但是，根据 PHP 文档，$_SERVER['HTTP_REFERER'] 是不可靠的:

This is set by the user agent. Not all user agents will set this, and some provide the ability to modify HTTP_REFERER as a feature. In short, it cannot really be trusted.

因此，另一个解决方案是在引用表单中添加一个附加字段并在 PHP 脚本中检索它，例如

<input name="referrer" type="hidden" value="<?php echo $_SERVER['PHP_SELF'];?>"/>

然后:

$page = $_REQUEST['referrer'];