csrf token 验证

index.php
```php
<?php 
//获取token，防止表单域下
$csrfToken = CsrfTokenClass::genCSRFToken();
?>
<input type="hidden" id="csrft" name="csrft" value="<?php echo $csrfToken;?>" />
```

index_do.php
```php
<?php
//csrf验证--ajax提交验证
CsrfTokenClass::ajaxGate($_POST['csrfToken']);

//csrf验证--表单提交验证
CsrfTokenClass::gate($_POST['csrfToken']);
?>
```

CsrfTokenClass.php
```php
<?php
class CsrfTokenClass {
	const EXPIRTIME = 20;	//分钟, 设置有效期
	
	/**
	 * 获取csrfid
	 * @return string
	 */
	private static function getCsrfID() {
		$csrfId = $_COOKIE['csrfid'];
		if(empty($csrfId)) {
			$csrfId = md5(time().rand(1000, 9999)).'sdfsdfsdfasdasdasd';
			setCookie('csrfid', $csrfId, time()+20*60, '/');
		}
		return $csrfId;
	}
	
	/**
	 * 获取csrftoken
	 * @return string
	 */
	public static function genCSRFToken() {
		$csrfId = self::getCsrfID();
		$csrfToken = md5(time().rand(10000, 99999)).'asdasddfgdfhfgdj';

$token = self::getCsrfKey($csrfId, $csrfToken);
		
		//存入db
		self::saveToken($token);        
		
		return $csrfToken;
	}
	
	/**
	 * 校验token值 -- 403错误
	 * @param string $postToken
	 * @return string
	 */
	public static function gate($postToken) {
		$csrfId = self::getCsrfID();
		$token = self::getCsrfKey($csrfId, $postToken);
		
		//查询db是否存在
		if (!self::getToken($token)) {
			header("HTTP/1.1 403 Forbidden");
			$aRtn = array('error'=>'校验出错');
			echo json_encode($aRtn);
			die();
		}
	}
	/**
	 * 校验token值 -- ajax校验
	 * @param unknown $postToken
	 */
	public static function ajaxGate($postToken) {
		$csrfId = self::getCsrfID();
		$token = self::getCsrfKey($csrfId, $postToken);
	
		//查询db是否存在
		if (!self::getToken($token)) {
			header("HTTP/1.1 403 Forbidden");
			$aRtn = array('error'=>'校验出错');
			echo json_encode($aRtn);
			die();
		}
	}
	/**
	 * 校验token值 -- 直接返回
	 * @param string $postToken
	 * @return boolean
	 */
	public static function isValid($postToken) {
		$csrfId = self::getCsrfID();
		$token = self::getCsrfKey($csrfId, $postToken);
		
		return self::getToken($token);
	}
	
	private static function getCsrfKey($csrfId, $csrfToken) {
		return md5('csrfid:' . $csrfId . ':' . $csrfToken);
	}
	
	private static function saveToken($token) {
		if(empty($token)) {
			return false;
		}
		return self::addCsrfToken($token);
	}
	
	private static function getToken($token) {
		if(empty($token)) {
			return false;
		}
		
		return self::getCsrfToken($token);
	}
	
	private static function addCsrfToken($token) {
		$sQuery = 'INSERT INTO 
						csrf_log 
					SET 
						token = "' . addslashes($token) . '",
						date_create = NOW()';
		return $oDB->exec($sQuery);
	}
	
	private static function getCsrfToken($token) {
		$sQuery = 'SELECT 
						* 
					FROM 
						csrf_log 
					WHERE 
						token = "' . addslashes($token) . '"
						AND DATE_FORMAT(ADDDATE(`date_create`, INTERVAL '.self::EXPIRTIME.' MINUTE), "%Y-%m-%d %H:%i:%s") >= NOW()';
		return $oDB->getRow($sQuery);
	}
}
```

Search result.

php实现zip压缩文件

PHP token 加密生成