using header redirect ... how to prevent malicous attack

I am redirecting , after a certain action to another form

using something like

header( "Location: http://www.example.com/thankyou.html" );

PHP:

how do i prevent people from accessing this unless they come from the desired page

i do not want anyone directly accessing thankyou.html

 

look up the referrer. you will be able to only show certain content if the referrer is a specific page

 

HTTP_Referer is one way.

And you can do something else (more complicated but more secure). Save a value in the session after the certain action your form does. Then at thankyou.php, check the value of the session before saying thank you.

 

can you explain more how to do the session thing

 

OK. You have a file/page where the form input goes and gets processed then you redirect to the thankyou page, right? In that processing file, if the input is OK, just add this:

$_SESSION['everythingisok'] = 1;

PHP:

In the thankyou file, check:

if($_SESSION['everythingisok'] == 1) {

}

PHP:

It is better than just passing variables. It makes you keep variables with you all the time when you are on the site.

N.B. Whenever you want to use sessions, don't forget to place this line in the very beginning of every file (or the main file id you use one master file) :

session_start();

PHP: