Want to Block custom Variable input from client

Help, Secuity Issue, Block url Injection of client

[altainta]

Here is the scenario

example url = http://example.com/download.php?file=temp.wmv

After u put that url in the browser it will automatically start downloading. No page or nothing..

For a Better Explanation check out

http://example.com/media/convert_megavideo.php

Whenever u try to pass the variable value (YOURSELF) it will give u a screen

May muon hack ha thang ngu? Bien di noi khac choi!
NO ATTACK INJECTION !

For example when u supply a Variable value url self

http://example.com/media/convert_megavideo.php?url=http%3A%2F%2Fexample.com%2F%3Fv%3DE8SZX6F1&submit=Download

It will put the error.. That is what i want....
How to do that ?
I have a lots of variable input in my PHP page and i want that security just because i am losing a lot of money because of this...

[edited by: eelixduppy at 6:45 am (utc) on Feb. 3, 2009]
[edit reason] removed specifics [/edit]

[altainta]

For example when u supply a Variable value urself (I meant Manually typing the Variable value of "url")

[altainta]

Any body ?

[caribguy]

If I understand your question correctly, you want to prevent that visitors type the URL in their browser and watch your videos or that other sites link directly to videos hosted on your site.

See these WebmasterWorld threads on preventing hotlinking of images and videos for some ideas:

[webmasterworld.com...]
[webmasterworld.com...]

[altainta]

Sorry to say but it is not like that...

what i mean to say is
I am site aaa.com and the other site is bbb.com (injector) and also take a end user (injector) browsing the aaa.com site with firefox or ie.

Now i have a script that does a Output after clicking the submit button (it is not video or something but it is a download link of freewares)
Now i don't want it to be used directly..

Example attack...

1)
End user manually supply particular url=[value] trough normal address bar of the browser by typing (remember the value doesn't have a particular ending extension e.g exa,txt,php,wmv,zip etc)

http://aaa.com/url=http://example.com/ddd/

or

http://aaa.com/url=http%3A//example.com/ddd/

now my problem is I want to stop that manual injection of variable value through address bar

2) A attacker could build a script that can take advantage of the above scenario.. example...

BBB.com decide to directly get the download link without going manually to the site (fetching)
so what he does is

$url = 'http://aaa.com/url=' . $randomvalue;
$downloadlink = file_get_contents($url);
//Some preg_match entries for extraction the download link of button download...
print $downloadlink;

Now BB.COM will display this download link on his site without even visiting my site....

Please help me avoid this situation i am already facing it a alot...

I don't know the proper name for this situation so i can't even search it over the net...

[edited by: coopster at 1:30 pm (utc) on Feb. 3, 2009]
[edit reason] removed link to non-authoritative site [/edit]

[caribguy]

I forgot: Welcome to WebmasterWorld altainta!

OK... Second try, you're referring to an anti-leech script. These are usually based on an MD5 hash of the visitor ip using md5($_SERVER['REMOTE_ADDR']);

Use the search function on top of this page or Google
site:webmasterworld.com anti leech

[altainta]

Still not able to get into right direction
Because
Every body state something about Bot/crawler and things with extension (e.g wmv,zip,gif,jpg) i do not want to protect that rather i want to have security over client side browser url injection of variable values to my script (or website)