The below goes in form.php/whatever.php

<?PHP $key = '"'.md5("key".date("Ymd").'"'; ?>
<form action="edit.php" method="post">
<input name="hash" type="hidden" value=<?PHP echo $key ?>>
</form>

Now this goes in edit.php/whatever.php

<?PHP
if ($_POST['hash'] != md5("key".date("Ymd")) {
  die("Restricted access!");
}
?>

I think that most of you understands what this does but just in case you don’t, in the form we have our hash key which is unique for your site and changes everyday. In the file that does the actual SQL query/other proccessing script we put in a line of pre that will “die” unless the correct key hash is entered.

Now this is just the basics of what you can do with key hashes, I have elaborated many systems with key hash security to be unique not only for the day but for every edit form, page or cookie. This will of course not stop the most relentless hackers but it will fend of a boatload of the less sofistacted hackers and bots.

Jan-Erik Lysander runs Lysander Consulting who specialise in IT / internet / web development.