php referers and redirects

riffy

Hi everyone,

I have a question regarding the HTTP_REFERER variable. How does it work?? I'm using it in a page I'm developing and it does not seem to be working, either that or my code is wrong.
I'm posting my code below.

<?
include "config.inc";
$sql = "SELECT * FROM information";
$result = mysql_query($sql);
$row = mysql_fetch_array($result);
extract($row);

$referer = "http://test.philipslighting.com/nam/events/lightfair/request.php?$email";

$ref1 = "http://test.philipslighting.com/nam/events/lightfair/check.php";

if (($HTTP_REFERER != $referer)) || ($HTTP_REFERER != $ref1)) {
  header ("Location: /nam/events/lightfair/checkemail.php");
  exit;
}
else {
?>

display page

<? } ?>

what is wrong with that code?? the page is not even reading the if statements because no matter what, it goes to checkemail.php and doesn't display the page at all

thanks in advance
arif

lobobr

If I'm not mistaken, you can only use the HTTP_REFERER as a variable if you have "register_globals" turned on in your php.ini

Try using:

$_SERVER{'HTTP_REFERER'}

instead of:

$HTTP_REFERER

Best regards,

m_tt

Just to correct the post above

$_SERVER['HTTP_REFERER'];

-or-

getenv('HTTP_REFERER');

m_tt

Also your code looks odd to me :p

$thisReferer = getenv('HTTP_REFERER');
if (($thisReferer != $referer) || ($thisReferer != $ref1))   {
  // Does not equal
} else {
  // Does equal
}

lobobr

Just to clarify:

$_SERVER{'HTTP_REFERER'} is not incorrect. I always use it like this and never got any errors.

Regards,

m_tt

Its not formal (to me), sue me 😉

superwormy

$_SERVER['REFERER'] is a client-set variable, so you know. Which means many times it won't be set at all, certain user-agents can be specifically told NOT to send this header, so you really shouldnt' be trusting it at all.

Someone clever could set the HTTP_REFERER header to whatever they wanted to set it to, anything at all.

riffy

thanks for all the help guys but it didn't help...i guess superwormy might be right and the option is shut off..because it's not even outputting any value for HTTP_REFERER

any other suggestions?...

basically what i'm trying to do is check to see what page the user is coming from so that the user does not directly type in http://test.philipslighting.com/nam/events/lightfair/literature_new.php for security reasons...the user is redirected to a page called checkemail.php which lets the user enter email address; after pressing submit, checkemail.php leads to check.php which is a redirect, either to literature_new.php if the email is already in the database or to request.php if the email isn't...

the literature_new.php page is checking to see if the user is coming from request.php or check.php and if so, the page is displayed otherwise there is a redirect as i stated...

however, my if statement is working when i'm using HTTP_REFERER or as how you guys suggested...is there any other way to perform this check?

thanks a whole lot
arif

lobobr

Yes, there is. You can use JavaScript.

The code you want is very similar with php in syntax and since you'll be running this on the client side it doesn't really matter if HTTP_REFERER is disabled on the server.

Best regards,

superwormy

Um... how is something client-side which is OFTEN disabled ( JavaScript ) better than something client-side which is NOT OFTEN disabled ( the result HTTP_REFERER varible )???

Honestly, I don't think there is much you can do.

You could do something like send them a cookie, but its still optional. You could pass a session ID or somethign similar through the URL, and maybe check that against a database... that's probably your best bet.

Does there need to be a redirect if the user hasn't visited the other page beforehand?

lobobr

I'm not saying JS is better :rolleyes:

I've just offered an option.