Re: Using HTTP_REFERRER to ensure forms posted from server
| From: | William Lovaton | Date: | Wed, 28 Apr 2004 13:08:48 +0000 |
| Subject: | Re: Using HTTP_REFERRER to ensure forms posted from server | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-184868@lists.php.net to get a copy of this message | ||
No, sessions doesn't have any thing to do with this. The real answer to
your problem is: data validation.
_Always_ verify the data you recieve in the server side.
-William
El mi? 28-04-2004 a las 04:25, De Greef Sébastien escribió:
> right, thats why i think you better work with sessions... isn't it ?
>
> "Marek Kilimajer" <kilimajer@webglobe.sk> a crit dans le message news:
> 408F6AF6.2060500@webglobe.sk...
> > Terence wrote:
> > > Dear All,
> > >
> > > To avoid malicious users creating their own forms and posting to my
> site, is
> > > it advisable to use the $_SERVER['HTTP_REFERRER'] to ensure that posted
> > > forms only come from the intended source? Anyone out there using this?
> > >
> > > Thanks
> > > Terence
> > >
> >
> > Useless, referrer can be also spoofed. And it can prevent users with
> > personal privacy tools installed from using your site.