get referer address with PHP

Discussion in 'PHP' started by ludwig, Jul 27, 2007.

  1. #1
    Hi guys

    we are encountering problems in getting the ref address of the browser.

    Lets say the page is game.php where there is a game in swf. After the player finished playing he needs to submit the score. The score is submitted to lets says submit.php with a POST method

    but the submit.php does not get the ref address we have tried almost all and every PHP scripts

    Please tell the way to go over it if you have ever encountered that type of problems
     
    ludwig, Jul 27, 2007 IP
  2. norfstar

    norfstar Peon

    Messages:
    1,154
    Likes Received:
    62
    Best Answers:
    0
    Trophy Points:
    0
    #2
    The HTTP referrer in PHP is a superglobal which is set at:

    $_SERVER['HTTP_REFERER']
    Code (markup):
    I don't know a great deal about Flash, but I suspect that if the form is being posted from within the .swf file rather than the HTML of the page itself, the browser may not declare that page as the referrer.

    The HTTP referrer is also something that can be easily removed or even faked, and its possible some software installed on your browser/computer may be affecting this.
     
    norfstar, Jul 27, 2007 IP
  3. nico_swd

    nico_swd Prominent Member

    Messages:
    4,153
    Likes Received:
    344
    Best Answers:
    18
    Trophy Points:
    375
    #3
    Don't rely on the referrer. It's sent by the browser, and not all browsers send it by default. Plus it can be easily modified.
     
    nico_swd, Jul 27, 2007 IP
  4. ludwig

    ludwig Notable Member

    Messages:
    2,253
    Likes Received:
    66
    Best Answers:
    0
    Trophy Points:
    225
    #4
    thanks for your help guys.

    the interesting thing is the ie returned the url of the swf file
    opera returned the url of the php file
    mozilla returned nothing :)

    we figured out other way for that with cookies, sessions on the server flash actionscripting and so on just to make sure we used all the possible methods.

    we also did a referer check, if it is not from our domain than it is fake :)
     
    ludwig, Jul 28, 2007 IP
  5. themole

    themole Peon

    Messages:
    82
    Likes Received:
    7
    Best Answers:
    0
    Trophy Points:
    0
    #5
    What they mean is it's easy to change what referrer is being sent to you. Referrers are generated by the browser and passed on with the request to your page. I know there's several Firefox extensions that make it really easy to disable or fake referrers (and there's likely the same for the other browser's). Many security/Anti-Virus programs totally disable sending referrers as well.

    The referrer comes from the user, so you need to treat it like any other data you receive from a user.

    -the mole
     
    themole, Jul 29, 2007 IP