Need some help with $HTTP_REFERRER

[Robo]

I have a registration form, people fill in the form, click submit, and it goes to the next step. I want to make sure that people started right from the start, and didn't skip pages. Here's my script:

<?php

case 'register2':
    //add user details from case 'register' to db

//check to make sure they came from page.php?action=register
if ($HTTP_REFERRER != '$PHP_SELF?action=register')
    {

    ?>
    <meta http-equiv="refresh" content="0; url=<?=$PHP_SELF ?>?action=register">
    <?

    exit;
    }

?>

I'm pretty sure I have some sort of syntax error at the line

if ($HTTP_REFERRER != '$PHP_SELF?action=register')

I'm not too sure how to correct it...

[firepages]

spelling? (not sure which is the 'correct' spelling) but


$HTTP_REFERER

is what PHP expects

[freakysid]

First - its $HTTP_REFERER PHP like myself cannot spell

Second - the problem is that you are using single quotes:
if*($HTTP_REFERRER*!=*'$PHP_SELF?action=register')
and you should use double quotes instead.

PHP treats strings enclosed by single quotes differently to strings enclosed by double quotes. PHP does *not* parse the contents of a single quote string. However, PHP parses the contents of a double quote string and substitutes the values of variables in the string. For example;

$foo = 'foo';
echo 'foo is: $foo';

will output : foo is $foo

However,
echo "foo is: $foo";

will output: foo is foo

So this should do the trick:
if*($HTTP_REFERRER*!=*"$PHP_SELF?action=register")

[firepages]

or

if ($HTTP_REFERER != "$PHP_SELF?action=register")

[freakysid]

or ...

Duh! Thank's firepages (me bad - lazy cut and paste job)

[sylow]

It can be nice to have a hidden variable in your form called

<input name="currentpage" TYPE="HIDDEN" VALUE="register"> 

then in your php code you can check which page they are coming, it looks more clean to me (IMHO)

[Robo]

Damn...I was never good at spelling...it was only last month that I started spelling available instead of avaliable.

For once I spelt something correctly, and look what happens!

[Robo]

Oh damn again...

The $HTTP_REFERER is working, but still got a slight problem...

$HTTP_REFERER gives:

http://localhost:8080/rave.php?action=register

While $PHP_SELF?action=register gives:

/rave.php?action=register

What would I need to do to make they say the same thing? The script will be use on different domains, but I would still like the script to check for the correct domain and path before processing.

[firepages]

basename($HTTP_REFERER);
should give you the filename & query string but without the leading forwardslash

so

$from="/".basename($HTTP_REFERER);
if ($from!= "$PHP_SELF?action=register") ;

may work.

"For once I spelt something correctly, and look what happens!"

very quotable!

[Robo]

I think I got it sorted, it checks that both the domain and the filename before redirecting:

<?php

if ($HTTP_REFERER != "http://$HTTP_HOST$PHP_SELF?action=register")
    {

    ?>
    <meta http-equiv="refresh" content="0; url=<?=$PHP_SELF ?>?action=register">
    <?

    exit;
    }

?>

[kunal]

http_referer doesnt work with all browsers

[Robo]

What browsers doesn't support $HTTP_REFERER?

[kunal]

hmm... it doesnt work in IE 5.5 or Netscape 4.74

[firepages]

does on mine (5.5) & I know that in very early versions of IE pre IE4 and I think the very first IE4 ,it was seen as a possible privacy thing and so it wasnt supported, but as NS did so did IE. NS6 often is confused as to 'who' it is but HTTP_REFERER should work on most if not all versions of NS