Question

If I want people only accessing a certain page on my webpage by using a link within my website, and not typing it in the address box then would this do…

Please note that the user would first have to login to their account and all member pages have been set so that the user must login into their account before accessing member pages.

if (isset($_SERVER['HTTP_REFERER'])) {

// show page content

}

else {

header('Location:http://');
exit();
}

Am I correct in saying, that if a link is clicked then the page will show, but if the link is not clicked and the address of where the link points to is typed in the address bar it will do a redirect.

I am asking as the link will direct people to a form, and I don’t want that form being accessed without first having some variables set on the previous page, or being accessed without logging in (as people could create their own link on another website which points to the same location)

Thanks

Answer 1

It is not secure in any way. From here:

The address of the page (if any) which referred the user agent to the
current page. This is set by the user agent. Not all user agents will
set this, and some provide the ability to modify HTTP_REFERER as a
feature. In short, it cannot really be trusted.