我有一个网站,允许用户提交POST请求以执行操作,并通过标准PHP会话cookie进行身份验证。举个极端的例子: <!-- real site !-->
<form action="http://victimserver.com/accountactions.php">
<input type=hidden name="request" value="delete_all_my_account_data">
This button will delete all your account data!