In some scenarios, $_SERVER["HTTP_REFERER"] will only work when php (php.ini) is configured with register_globals bool configured to on.
Register globals can allow exploitation in loosely coded php applications. Commonly in apps that allow users to post data.
I have used the following method in the past to check referrers in applications where I controll the operator input.
session_start();
if(!isset($_SESSION['url_referer']))
{
$_SESSION['url_referer'] = $_SERVER['HTTP_REFERER'];
}
Without hashing strings in session variables, I do not know of a more efficient practice. Does anyone know the best practices?
Finest Regards,
Brad