HTTP_REFERER

LiamBailey

I have been told on this forum that $_SERVER['HTTP_REFERER'] is unreliable, but in what way?

I have a form that sends three values using get to another form page where they are sent to the following page as hidden values, but if the user leaves required fields empty or enters otherwise invalid data I need to send them back to the exact same url, query strings included, PHP_REFERER seems like a good way to do this, but I have a backup plan if someone can confirm why this is unreliable.

Thanks

LiamBailey

And also, I have asked this before but didn't implement it at the time, and now I am so need to ask again.

How do I insert the values from all the forms into the same db row, would it be,

$sql = ("INSERT INTO mytable (id,something,or,other) VALUES ('null','$what','$to','$do')");
$action = mysql_query($sql);
$customer_id = mysql_affected_row($action);

AND on the next form

$sql = ("UPDATE INTO mytable (next,set,of,fields) VALUES ('$next','$set','$of','$values') WHERE id=$customer_id");
$action = mysql_query($sql);

And so on?

NogDog

The REFERER header is not a required HTTP header, so clients are not obligated to send it. Even if the user's browser sends it, if he goes through a proxy then that proxy may not forward it. And in any case, it's very easy to spoof it should a user (malicious or otherwise) wish to do so.

For the insert question, use mysql_insert_id() to get the ID (affected rows is the number of rows inserted).

Alternatively, store all the inputs in the $_SESSION array (which of course means using session_start(), etc.) and just do one insert when everything has been successfully entered and validated.

peytonrm

I think the reason you have heard not to trust HTTP_Referrer is that it can be easily manipulated by the client, so it is not secure. You aren't trying to rely on it for any security measure, so I think it's fine in your case.

For your second question, I think that would be fine. Alternatively, you could store the info from the first forms in the session and commit all of it in one transaction at the end.

peytonrm

haha, looks like there's an echo in here.

Guess I took a little too long typing before posting.

bradgrafelman

As has been said, you should never rely on the field (e.g. make some functionality depend on it being accurate or even present at all). It's a great way to do as you're saying, though - send the user back to the previous page.

You should definitely use [man]isset/man to first check if this value was even sent, however, and provide some sort of default "back" location if needed.

LiamBailey

Got it sorted with mysql_insert_id() (once I discovered that it didn't need an argument)

But now I'm banging my head against a brick wall as I can't get my update query to work.

I have read three tutorials and implemented it the way they did it and nothing, I have also updated my table using php_myadmin and done it that way and still nothing, that is the way I have it now.

I now have this:

$mid = $_POST['memb_id'];
$query = "UPDATE loyalty SET
Account_Status = 'Validated',
Name = '$name',
Telephone_Number = '$telephone',
Date_of_Birth = '$dob',
Date_1 = '$date_1',
Date_2 = '$date_2',
Date_3 = '$date_3',
Date_4 = '$date_4',
Date_5 = '$date_5' WHERE Account_id=$mid LIMIT 1";
$result = mysql_query($query) or die(mysql_error());

And the error is:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'LIMIT 1' at line 10

NogDog

First thing I'd do is output the actual query along with the error to see if any variables were empty or such:

$result = mysql_query($query) or die(mysql_error() . "<br />\n$query");

LiamBailey

Picture a beaver, beavering away, never giving up.

I got it. Thanks for all the help guys