Question

I have to code a page that will only allow users that click on a specific link to access that page. I don’t want people to be able to type the address directly into the address bar and have access. Only from a specific page and a specific link on that page.

Security is important as it is for a product download.

Anyone know how I would do this in PHP?

Answer 1

Your best bet is to use sessions and have a user authenticated. Then you check whether they have logged in at the top of this “download” script.

Alternatively, you can check use the $_SERVER['HTTP_REFERER'] variable and check at the top of your page that they are coming from the correct place. This would (I think) prevent users from just going straight to the download page by typing in the URL

if ($_SERVER['HTTP_REFERER'] == 'http://mysite.com/downloadlist.php') {
    //proceed
} else {
    //kick user out
}

But like I said, sessions are the way to go here. From the PHP manual on HTTP_REFERER:

The address of the page (if any) which referred the user agent to the
current page. This is set by the user agent. Not all user agents will
set this, and some provide the ability to modify HTTP_REFERER as a
feature. In short, it cannot really be trusted.