note 17038 added to language.variables.predefined

If you are writing a script that say posted to a guestbook and you are restricting the pages that can post to it by using if($HTTP_REFERER != "http://$HTTP_HOST;$SCRIPT_NAME"){ echo "Unauthorised"; die(); }else{ //on with writing the file } Then It is possible to get arround that my spoofing the HTTP_REFERER. Using a program like: Net.deamon or Net Scan Tools. So don't rely on that to protect your pages. You might want to consider creating a random variable that the user has to enter into a text field to authenticate themselves to the script. Just to show that they have been to the "Authorised" page.. Hope this helps someone. (I had my guest book flooded by someones evil php script from another server.) -- http://www.php.net/manual/en/language.variables.predefined.php http://master.php.net/manage/user-notes.php?action=edit+17038 http://master.php.net/manage/user-notes.php?action=delete+17038 http://master.php.net/manage/user-notes.php?action=reject+17038