Thinkphp SMS notification verification code access [How can the platform prevent SMS from being swiped]

 yuli September 9, 2019 16:19:34 PHP technology comment two hundred and nineteen Reading mode

Information notification is a very important platform for customer contact in today's network information age. For a diversified network society, there are more and more new notification means emerging, Vx public hao, voice notification, SMS notification, email notification, etc. For small and medium-sized platforms, I think the most economical and practical and the highest delivery rate is still the most original SMS notification. For junior technicians, you must know something about SMS notification, including platform quality, sending requirements and docking.

thinkphp 短信通知验证码接入【平台怎么防止被刷短信】

From the used SMS platforms, first, AliCloud SMS is the cheapest and delivered in time. If you have an AliCloud account, this is the first choice; Second, the network built SMS does not need to be reported. The relative price of SMS is OK. The delivery speed is basically 5 seconds after the customer service is transferred to channel 106. If users who do not want to authenticate recommend using the network built SMS, they do not need to use their real names, and SMS does not need to be reported. The connection is also very convenient. The delivery speed and price are acceptable.

Let me take thinkphp as an example to demonstrate how to connect to the SMS platform from the SMS registration verification code. The registration verification code is relatively complicated. I have to say something here. How can we prevent someone from stealing SMS messages? Because from a rigorous point of view, the registration process is the part exposed to all users and the place most likely to be stolen. Generally, a graphic verification code is added before sending. If the graphic verification code and mobile phone number are judged correctly, the message can be sent successfully; After receiving the verification code successfully, you must make two judgments: first, judge whether the received mobile phone number is the entered number, and second, judge whether the verification code is consistent with the one generated at the time of sending. Without saying much, the first part is the code. In the first part, the thinkphp foreground html page directly embeds the code, triggers the sending of the verification code through js, and resends the code countdown.

<script type="text/javascript">

var wait = 60;

function time(o) {

if ($("#phone").val() == "") {
Layer.msg ("Please fill in the mobile number");
return false;
}

if ($("#code").val() == "") {
Layer.msg ("Please fill in the graphic verification code");
return false;
}
$.post("{:U('Reg/sendPhone')}", { phone: $("#phone").val() ,code: $("#code").val()}, function(msg) {

if(msg.sf==0){
Layer.msg ("The verification code has been sent, please check");
}else{
Layer.msg ("Sending failed");
}
},'json');

okssss(o);
}
var wait = 60;
function okssss(o) {
if (wait == 0) {
$(o).removeAttr("disabled");
$(o). val ("Free access to verification code");
wait = 120;
} else {
$(o).attr("disabled", true);
$(o). val ("Resend ("+wait+")");
wait--;
setTimeout(function() {
okssss(o);
},
1000);
}
}
</script>

The foreground html page submits the sending request through the {: U ('Reg/sendPhone ')} method. A graphic verification code is added to the sendphone for judgment, and then the session saves the mobile phone number of the request and the randomly generated verification code for use when submitting the form.

The code of the sendPhone method is as follows:

if (IS_POST) {if (IS_POST) {        $phone = $_POST['phone'];  $code = $_POST['code'];if(!$ This ->check_verify ($code)) {$this ->ajaxReturn (array ('nr '=>'Bad verification code!', 'sf'=>1));} else {$rand=rand (1000000900000); session ('CHECK_CODE ', $rand); session ('PHONE_NUM', $phone); $info=sendSMS ($phone, "Your verification code is" .$rand. ", please do not disclose. [Huixin Lianhua Community]");         preg_match('/stat=([\d]{3})/', $info, $matches); If (is_array ($matches)&&$matches [1]==100) {session ('check_status', 1);} else {session ('check_status', 0);} $this ->ajaxReturn (array ('nr '=>' Send successfully! ',' sf '=>0));}}

The above is the whole core sending process, in which sendSMS is the API sending interface of the SMS platform. Different platforms may send messages in different ways, including post and get. Then the returned results should also be determined according to the return values of different SMS platforms. In the above case, the return value of 100 indicates the successful sending. A sendSMS code is attached below

function sendSMS($mobile,$content,$mobileids='',$http=' http://xxxx SMS platform API interface/'){
$uid = 'xxx';//// SMS platform account
$pwd = 'xxxx';//// SMS platform key
return send($http,$uid,$pwd,$mobile,$content,$mobileids);

}

function send($http,$uid,$pwd,$mobile,$content,$mobileids,$time='',$mid='')
{

$data = array(
'uid'=>$uid,//user account
'pwd'=>md5 ($pwd. $uid),//MD5 bit 32 password, password and user name concatenate characters
'mobile '=>$mobile,//number
'content'=>$content,//content
'mobileids'=>$mobileids,
'time '=>$time,//Send regularly
);
$re= postSMS($http,$data); // POST submission
file_put_contents("sms.txt", $re.$content);
return $re;
}

function postSMS($url,$data='')
{
$port="";
$post="";
$row = parse_url($url);
$host = $row['host'];
$port = $row['port'] ? $ row['port']:80;
$file = $row['path'];
while (list($k,$v) = each($data))
{
$post .= rawurlencode($k). "=".rawurlencode($v). "&"; // Transfer to URL standard code
}
$post = substr( $post , 0 , -1 );
$len = strlen($post);
$fp = @fsockopen( $host ,$port, $errno, $errstr, 10);
if (!$ fp) {
return "$errstr ($errno)\n";
} else {
$receive = '';
$out = "POST $file HTTP/1.1\r\n";
$out .= "Host: $host\r\n";
$out .= "Content-type: application/x-www-form-urlencoded\r\n";
$out .= "Connection: Close\r\n";
$out .= "Content-Length: $len\r\n\r\n";
$out .= $ post;
fwrite($fp, $out);
while (! feof($fp)) {
$receive .= fgets($fp, 128);
}
fclose($fp);
$receive = explode("\r\n\r\n",$receive);
unset($receive[0]);
return implode("",$receive);
}
}

The above is the API sending interface demo of a short message platform. In particular, when sending, some short message platforms require different codes. You must preprocess the sent content according to the coding requirements of the short message platform, or the sent content will be garbled. Next, when we submit the form, we can directly judge whether the SMS verification code and the received mobile phone number are the same as the mobile phone number that sent the request.

To sum up, several points should be paid attention to in the SMS interface: 1. To prevent SMS from being stolen, it is better to add a graphic verification code. 2. Add the judgment of whether the mobile phone number is consistent to avoid the situation of mobile phone receiving.

 yuli
  • This article is written by Published on September 9, 2019 16:19:34
  • This article is collected and sorted by the website of Mutual Benefit, and the email address for problem feedback is: wosnnet@foxmail.com , please keep the link of this article for reprinting: https://wosn.net/3818.html

Comment