I'm thinking of putting up a thank you page. Wondering how not to get this to show easily if it's just requested directly. There is 2 way to trigger this, contact form sent successfully and payment form too. Was thinking of using HTTP_REFERER but that is not reliable since it can be faked, or blanked, etc.. . sessions? generated hash? Bah I think I shouldn't even bother with this and just have it as a normal page. It's not a security issue anyway. lols But any suggestions guys?
Well, sessions seem to be the most logical solution. Set on the payment processing page, check on your thank you page. Problem there is ofcourse what if the user wants to return to that page in the future? You'd need to build a login functionality for returning users of some kind.
It depends of the payment method you use. Some payment systems offer to you 3D secure functions, which means you contact directly payment confirmation script on secure connection and you will get result. Then you can display text based on this result.