How can PHP be used to detect and prevent direct URL submissions of form parameters?

Direct URL submissions of form parameters can be detected and prevented by checking if the form was actually submitted from the intended form page. This can be done by adding a hidden field to the form with a unique token generated on the form page, and then verifying this token on the form submission page. If the token is not present or does not match, then the submission can be rejected. 

<?php
session_start();

// Generate a unique token
$token = md5(uniqid(rand(), true));
$_SESSION['token'] = $token;

// Include this hidden field in the form
echo '<input type="hidden" name="token" value="' . $token . '">';

// On the form submission page, verify the token
if ($_POST['token'] !== $_SESSION['token']) {
    // Token does not match, reject the submission
    die('Direct URL submission detected. Please submit the form from the intended page.');
} else {
    // Token matches, process the form submission
    // Your code here
}
?>

Keywords

PHP form submission URL detection security validation

Related Questions