note 20409 deleted from ref.mail by nlopess
| From: | nlopess@php.net | Date: | Tue, 27 Apr 2004 13:15:23 +0000 |
| Subject: | note 20409 deleted from ref.mail by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-68873@lists.php.net to get a copy of this message | ||
Note Submitter: drtebi@yahoo.com
----
Hi there,
here is a little snippet that can be used in your mail script in order to check if the mail was
really sent from the domain the message originated from:
// array for allowed domains (lower case please)
$referers = array('php.net', 'www.php.net', 'us2.php.net');
// add upper case referrers
$size = sizeof($referers);
for($i = 0; $i < $size; $i++){
$referers[] = strtoupper($referers[$i]);
}
// check referers
for($i = 0; $i < sizeof($referers); $i++){
if(substr($HTTP_SERVER_VARS['HTTP_REFERER'], 7, strlen($referers[$i])) ==
$referers[$i]){
$bad_referer = FALSE;
break;
}
else{
$bad_referer = TRUE;
}
}
if($bad_referer){
header('Location: http://php.net/badreferer.php');
exit;
}
I added the upper case domains, since once in a while surfers tend to write in all-caps.
Hope that helps someone :-)
DrTebi