Hi,
the following snipplet is a very very basic one but it would check if the page one called has been requested by clicking on a link of a page previously sent by the same server:
Assuming that the script has the name redirect.wml and you call it with e.g. redirect.wml?tgt=urlencode("http://www.google.com") or something like that. If you even don't want the users to see the urlencoded tgt you could encrypt the target with e.g. mcrypt, convert that into a string to be used as get parameter, and decrypt it afterwards in the referer.wml script.
<?PHP
if (strstr($_SERVER['HTTP_REFERER'],$_SERVER['HTTP_HOST'])) {
header("Location: ".urldecode($_GET['tgt']));
} else {
header("Location: index.wml");
}
?>
If you put
if (!strstr($_SERVER['HTTP_REFERER'],$_SERVER['HTTP_HOST'])) {
header("Location: index.wml");
}
in all scripts you don't want to be requested directly these scripts would redirect to index.wml if someone requests the pages directly.