Question

what is the best way to make a page can only be accessed from an another page. (e.g: step2 page can only be accessed from step 1 page)

I thought about several methods such as:

use form submit from step1 to step2, in step 2 need to check post data

check $_SERVER['HTTP_REFERER'], allow if the referer is step 1

Answer 1

Using sessions is the only possible way.

if ($_SESSION['step'] <> 2) {
   // do something terrible (c) Cousin Avi
}