ci框架如何手动进行csrf攻击防范

0.修改application/config/$config.php文件中
$config['csrf_protection'] = false;

1.修改system/core/Security.php文件注释掉


function __construct()其中的第一行代码如下
//if (config_item('csrf_protection') === TRUE)
 
2.手动使用


1>controller

public  function  index()
{
$data  =  new  stdClass();
$data ->token_name =  $this ->security->get_csrf_token_name();
$data ->token_hash =  $this ->security->get_csrf_hash();

$this ->load->view(  'sec' ,  $data  );
}

2>view文件

 "utf-8" />
 security check!


"post"  action= "/index.php/sec/post" >
for = "user" >user
"user"  name= "user"  value= "" />
for = "age" >age
"age"  name= "age"  value= "" />
"submit"  value= "提交" />
"hidden"  name= ""  value= "" />

3>提交

public  function  post()
{
     $this ->security->csrf_verify(); //csrf检查

     var_dump(  $_POST  );

}