如何防止用户绕过必须遵循的步骤的过程？

我有一个多表单向导，需要完成多个步骤，该脚本可防止用户填写的数据丢失并防止用户步骤丢失。

脚本步骤保存在避免回到开头的会话中，始终将它们保留在用户的当前步骤中。

但是我在需要遵循的步骤的过程中存在漏洞问题。

如果恶意用户更改 URL 值，如下所示：

localhost/wizard/saveTemp.php?step=6

该恶意用户可以随意跳过这些步骤，从而绕过系统。

例子：

用户在步骤1中，但我修改URL并自动跳转到步骤6。

注意：第二种绕过系统的方法是通过添加或代码来修改&HTML链接的代码。示例：就像修改URL一样自动跳转到 step 。atráscontinuarmulti form wizardconsolaatributosjavascript <a href="#" class="next" onclick="show_step('6')>Continuar</a> PHP6

然后，

• 如何通过使用添加强化控件来防止系统被嘲笑PHP，其中用户不能从一步1到一步3或一步6，但必须继续步骤的顺序1, 2, 3, 4, 5, 6等等。

• 如何PHP使用 Javascript 的现有验证集验证向导表单的字段？

我的代码

脚本向导

<?php
session_start();
if (isset($_GET['p'])) {
  session_destroy();
  session_start();
}
?>

<script>
var currentStep =  <?php echo $step ?>; // Variable indicating the current step, data selected with PHP sessions
var radio = <?php echo $radio ?>; //Value of the radius selected

function show_step(step) {
    var data = $("#form").serialize();
    var url = 'saveTemp.php?step=' + step;
    var valid = true;

    // [OPTIONAL] Validate only if you are going forward
    if (currentStep < step) {

      // We search all the fields within the current step.
      $('#step' + currentStep).find('input,textarea,select').each((idx, el) => {
        let $field = $(el);
        let $fieldCont = $field.closest('.form-group');

        // If the field is a checkbox or a radio and an option was not selected
        if (($field.prop('type') == 'checkbox' || $field.prop('type') == 'radio') &&
            !$fieldCont.find('input[name="'+$field.prop('name')+'"]:checked').length) {
          $fieldCont.addClass('error');
          valid = false;
        }
        // If the field is NOT a checkbox or a radio and is empty
        else if ($field.prop('type') != 'checkbox' && $field.prop('type') != 'radio' &&
          !$field.val()) {
          $fieldCont.addClass('error');
          valid = false;
        } else {
          $fieldCont.removeClass('error');
        }
      });
    }

    // If at least one field was not completed
    if (!valid) {
      return;
    }

    //
    $.ajax({
      type: "POST",
      url: url,
      data: data
    }).done(function(resp){
      $('#radio').val(resp.radio);

      if (step === 2) {
        var radio = parseInt(resp.radio);
        switch(radio) {
          case 1:
            urlform = './app/themes/pay_paypal.php'
            break;
          case 2:
            urlform = './app/themes/pay_paypal2.php'
            break;
          case 3:
            urlform = './app/themes/pay_paypal3.php'
            break;
          default:
            urlform = './app/themes/pay_paypal4.php'
            break;

        }

 $('#divPay').load(urlform,function(responseTxt, statusTxt, xhr){
          if(statusTxt === "success") {

            $('#step' + currentStep).css("display", "none");
            $('#step' + step).fadeIn("slow");
            currentStep = step;
          }
          if(statusTxt === "error") {
            //
          }
        });
      } else {

        $('#step' + currentStep).css("display", "none");
        $('#step' + step).fadeIn("slow");
        currentStep = step;
      }
    });
  };

  $(function() {
    show_step(currentStep);
    $('a.next').click(e => {
      e.preventDefault();
      show_step(currentStep + 1);
    });

    $('a.back').click(e => {
      e.preventDefault();
      show_step(currentStep - 1);
    });
  });
</script>

HTML结构

<form id="form">
  <div id="step1" class="step">
    <h1>Step 1</h1>
    <a href="#next" class="next">next</a>
  </div>
  <div id="step2" class="step">
    <h1>Step 2</h1>
    <a href="#back" class="back">back</a>
    <a href="#next" class="next">next</a>
  </div>
  <div id="step3" class="step">
    <h1>Step 3</h1>
    <a href="#back" class="back">back</a>
    <a href="#next" class="next">next</a>
  </div>
  <div id="step4" class="step">
    <h1>Step 3</h1>
    <a href="#back" class="back">back</a>
    <a href="#next" class="next">next</a>
  </div>
  <div id="step5" class="step">
    <h1>Step 3</h1>
    <a href="#back" class="back">back</a>
    <a href="#next" class="next">next</a>
  </div>
  <div id="step6" class="step">
    <h1>Step 4</h1>
    <a href="#back" class="back">back</a>
  </div>
</form>

保存临时文件

注意：已收到评论说程序错误，您现在无法传递数据POST并GET实际使用它，?在这些评论之前对我来说是未知的，此程序是由Xerif 的回应采取的

<?php
session_start();

$step =  isset($_GET['step']) ?  $_GET['step'] : 1;

// We save the form data in a session variable
$_SESSION['datos_form'] = $_POST;
// we also add the step to the array, you can not use this name (__step__) as name in the form

$datosForm = (isset($_SESSION['datos_form']) && is_array($_SESSION['datos_form'])) ? $_SESSION['datos_form'] :array();

$sStep = isset($datosForm['__step__']) ? $datosForm['__step__'] : 1;
$step = isset($step) ? $step : $sStep;

$radio   = isset($datosForm['radio']) ? $datosForm['radio'] : 1;

$_SESSION['datos_form']['__step__'] = $step;

header('Content-Type: application/json');

$json =  array(
  'radio'     => $radio,
  'step'      => $step
);

echo json_encode($json);