Create a token which you use for page request validation, and if the stored token doesn't match the given one, or if none is given, display your error. I.e.
session_start();
# if SESSION['pagetoken'] doesn't exist, it's this user's first page request during this session
if (isset($_SESSION['pagetoken']) &&
(!isset($_GET['pagetoken']) || $_GET['pagetoken'] != $_SESSION['pagetoken']))
{
echo 'error';
# link back to valid page?
exit;
}
# create new token
$_SESSION['pagetoken'] = md5(microtime());
# Then, all links need to have this token appended, and for form posts you either use
printf('action="?pagetoken=%s', $_SESSION['pagetoken']);
# or (which would require that you also check $_POST)
printf('<input type="text" name="pagetoken" value="%s" />', $_SESSION['pagetoken']);
# and for links
printf('<a href="?pagetoken=%s">New page</a>', $_SESSION['pagetoken']);
Now, if I check the html source of the current page, I can obviously open a new tab or window and manually enter address: http://example.com/somepage.php?pagetoken=COPYPASTE
However, while doing so, I will also invalidate the initial window's/tab's page, since it now contains an outdated token, so if the user clicks a link in that window/tab, it will now produce an error. So far, I believe everything is ok.
But, since it's also possible to hold CTRL or CMD while clicking a link to open it in a new tab/window, I'm not certain it really is a good idea to do what you're asking for.
