Re: $referrer = $_SERVER['HTTP_REFERER'] echo

Path	csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!news.internetdienste.de!noris.net!newsfeed.arcor.de!newsspool1.arcor-online.net!news.arcor.de.POSTED!not-for-mail
Content-Type	text/plain; charset="UTF-8"
Message-ID	<11636905.NVDnM4sIge@PointedEars.de> (permalink)
From	Thomas 'PointedEars' Lahn <PointedEars@web.de>
Reply-To	Thomas 'PointedEars' Lahn <php@PointedEars.de>
Organization	PointedEars Software (PES)
Date	Fri, 28 Jun 2013 00:19:27 +0200
User-Agent	KNode/4.10.4
Content-Transfer-Encoding	8Bit
X-Face	%i>XG-yXR'\"2P/C_aO%~;2o~?g0pPKmbOw^=NT`tprDEf++D.m7"}HW6.#=U:?2GGctkL,f89@H46O$ASoW&?s}.k+&.<b';Md8`dH6iqhT)6C^.Px\|[=M@7=Ik[_w<%n1Up"LPQNu2m8\|L!/3iby{-]A+#YE}Kl{Cw$\U!kD%K}\2jz"QQP6Uqr],./"?;=4v
Face	iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAGFBMVEXTxa4RFk5dUWANED8PFEfy7+MGBiW+n3ZNF/QuAAACaElEQVQ4jVXUwVOcMBQG8Dc7Rc4PUntdWV2uxjDpGaGeozOp1woar4jd5t/v9wLstMwsA/ntlxdCAgUc1hjTc9/JCZfGoo3wG3HdmdAWrIJRHe7GM/TmpY5VFefuVcAkkPbLIaN8rmPmjloyZxgyR3GuJ4K0AGtJ2htz8o7yqikm759fldQXaMpbDzjKAG+8v+AugVTOPO5DOjLvGtUYQwh0CPjnVMyGd+8/GfUB5nLKJDD2aLDh5HYyMDJGDwQIo2ZmZcKbowNmAdB/AzyFhrmF2MHRb0QJJfaAnwGB6orZhoykLzJtGwF/xpYxI1dswomiUj3gTuAIqCn/4C7cULwGNBtwMTk3Y4LfKB5YUaOKBKYtpplm7u0vip8tU1NWWyI/7XdcSuIDoMt6rVHMWT0DbjHPGqDqZVSa6zleLcUTcIKLoMv3ueJluALtAo9B302zPPlrtiVScRdCjXvVh3e3JpYa/jjkuC9N+LrBMlz/eAN4eQijX2EdLo6c5tGGHwLyHFtXk89dDGHwCVhG9T0S/j55AhRZgkMCmUQXJ49TnS1wnQDvw0eAh9ICeMmEFbCnPMFzjAvsWoEWEFdYEx+S0MoUZ1gT1wId8+AF3Bl2OoEu906AUHx5VLw/gXYg/x84loOah/2UYNrgiwSwGO7RfUzVBbx/kgpckumGOi6QirtD6gkLTitbnxNol47S2jVc2vsN5kPqaAHT8uUdAJM4v/DanjYOwmUjWznGfwB7sGtAtor5BgofDuzaRj4kSQAqDakTsKORa3Q3xKi3gE1fhl71KRMqrdZ2AWNNg/YOhQyrVBnb+i+nEg4bsDA+egAAAABJRU5ErkJggg==
Subject	Re: $referrer = $_SERVER['HTTP_REFERER'] echo
Newsgroups	comp.lang.php
References	<kqiah2$5r6$1@speranza.aioe.org> <51ccb0f4$0$6583$9b4e6d93@newsspool3.arcor-online.net>
MIME-Version	1.0
Lines	30
NNTP-Posting-Date	28 Jun 2013 00:19:29 CEST
NNTP-Posting-Host	3d6e1830.newsspool4.arcor-online.net
X-Trace	DXC=<\3lbY^263NA<A_d>@P]\D4IUK<Cl32<A4Fo<]lROoRA8kF<OcfhCOK:;[^=Pn_eYADZm8W4\YJNLb@mF9jNikdE7a5\<`>]gfN8GShlGgG=3M
X-Complaints-To	usenet-abuse@arcor.de
Xref	csiph.com comp.lang.php:9907

Show key headers only | View raw

Christoph Michael Becker wrote:

> […] You may consider to use only simple expressions for an if expression,
> e.g.:
> 
>   $cameFromExpectedPage = substr($referrer, -13) === 'formcheck.php';
>   if ($cameFromExpectedPage) {
>     echo 'Something showed up';
>   }

Good idea, but I would write

  $cameFromExpectedPage = (substr($referrer, -13) === 'formcheck.php');

for even greater clarity.

Also, I would let match RFC 3986, Appendix B, against a URI.  What if there 
is a query part, for example?

But I would never check against the HTTP-Referer [sic!] in the first place.  
There are much more reliable solutions, like session variables.  See also 
<https://owasp.org/>.

PointedEars
-- 
Sometimes, what you learn is wrong. If those wrong ideas are close to the 
root of the knowledge tree you build on a particular subject, pruning the 
bad branches can sometimes cause the whole tree to collapse.
  -- Mike Duffy in cljs, <news:Xns9FB6521286DB8invalidcom@94.75.214.39>

Thread

$referrer = $_SERVER['HTTP_REFERER'] echo Twayne <nobody@spamcop.net> - 2013-06-27 17:23 -0400
  RESOLVED Re: $referrer = $_SERVER['HTTP_REFERER'] echo Twayne <nobody@spamcop.net> - 2013-06-27 17:34 -0400
  Re: $referrer = $_SERVER['HTTP_REFERER'] echo Christoph Michael Becker <cmbecker69@arcor.de> - 2013-06-27 23:40 +0200
    Re: $referrer = $_SERVER['HTTP_REFERER'] echo Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-06-28 00:19 +0200
      Re: $referrer = $_SERVER['HTTP_REFERER'] echo Christoph Michael Becker <cmbecker69@arcor.de> - 2013-06-28 02:16 +0200
        Re: $referrer = $_SERVER['HTTP_REFERER'] echo Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-06-28 10:56 +0200
          Re: $referrer = $_SERVER['HTTP_REFERER'] echo Christoph Michael Becker <cmbecker69@arcor.de> - 2013-06-28 20:03 +0200
            Re: $referrer = $_SERVER['HTTP_REFERER'] echo Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-06-28 21:49 +0200
              Re: $referrer = $_SERVER['HTTP_REFERER'] echo Christoph Michael Becker <cmbecker69@arcor.de> - 2013-06-28 22:37 +0200
                Re: $referrer = $_SERVER['HTTP_REFERER'] echo Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-06-28 23:55 +0200
      Re: $referrer = $_SERVER['HTTP_REFERER'] echo Twayne <nobody@spamcop.net> - 2013-06-28 13:49 -0400
        Re: $referrer = $_SERVER['HTTP_REFERER'] echo Christoph Michael Becker <cmbecker69@arcor.de> - 2013-06-28 20:13 +0200
    Re: $referrer = $_SERVER['HTTP_REFERER'] echo Twayne <nobody@spamcop.net> - 2013-06-28 13:33 -0400
  Re: $referrer = $_SERVER['HTTP_REFERER'] echo Jerry Stuckle <jstucklex@attglobal.net> - 2013-06-27 17:52 -0400
    Re: $referrer = $_SERVER['HTTP_REFERER'] echo Twayne <nobody@spamcop.net> - 2013-06-28 14:07 -0400
      Re: $referrer = $_SERVER['HTTP_REFERER'] echo Jerry Stuckle <jstucklex@attglobal.net> - 2013-06-28 15:26 -0400
        Re: $referrer = $_SERVER['HTTP_REFERER'] echo Twayne <nobody@spamcop.net> - 2013-06-28 16:03 -0400
          Re: $referrer = $_SERVER['HTTP_REFERER'] echo Jerry Stuckle <jstucklex@attglobal.net> - 2013-06-28 16:07 -0400
            Re: $referrer = $_SERVER['HTTP_REFERER'] echo Christoph Michael Becker <cmbecker69@arcor.de> - 2013-06-28 22:46 +0200
              Re: $referrer = $_SERVER['HTTP_REFERER'] echo Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-06-28 23:58 +0200

csiph-web