Disguised judgment code for cross-domain form submission status

Disguised judgment code for cross-domain form submission status_javascript skills

WBOY

Release： 2016-05-16 18:42:02

Original

1202 people have browsed it

Thinking about it, if the internal page information of the iframe can be obtained at first, then when it cannot be obtained, doesn't it mean that the form has been submitted~
We found that the information in the lower right corner of Baidu's bidding is also judged by this method. You can refer to it.
Example:

test.html:

Copy code The code is as follows:

Note that the following code is Cross-domain, not under the same domain name
testaction.php

Copy code The code is as follows:

 
sleep(5); 
echo $_POST['dddd']; 
?> 

Disadvantages:
This disadvantage It is also obvious that if it is a 404, 403, 500, etc. error, it will be mistaken for a successful submission.
So, please note: this method is for research and is used to develop thinking.
This is Baidu’s judgment code

Copy the code The code is as follows:

var sfMessTimes ; 
function sfMessSubmitMonitor () { 
try{ 
var hash = sf_mess_lib.getElement(SF_MESS_FRAME_ID).contentWindow.location.hash; 
 sfMessTimes ; 
 if (sfMessTimes > 5 0) { 
          alert(sf_mess_msg.fail); < l; i ) { 
 document.getElementById(SF_MESS_PREFIX sf_mess_cols[i].idname).disabled = false; 
                                             } 
} catch (e) { 
sf_mess_lib.getElement(SF_MESS_FRAME_ID).src = "about:blank"; 
 alert(sf_mess_msg.success); 
sf_mess_lib.getElement(SF_MESS_SUBMIT_ID).disabled = false; 
 for (var i = 0, l = sf_mess_cols.length; i < l; i ) { 
 var inputCfg = sf_mess_cols[i]; var inputEl = document.getElementById(SF_MESS_PREFIX inputCfg.idname); 
         inputEl.disabled = false; 
                                           inputEl.value = filtInnertip(inputCfg.innertip);                                 