How to redirect based on $_SERVER["HTTP_REFERER"]?

**Per Gustafsson** · Jul 17 '05, 07:39 AM

Re: How to redirect based on $_SERVER["HTTP_REFE RER"]?

deko wrote:[color=blue]
> I have a page that I don't want anyone to be able to link directly to. The
> page should only be accessed from gatepage.php. I tried this code, but keep
> getting errors - "header info already sent", or something like that... Am I
> missing something, or is there a better way to do this?
>
> <?php
> $ref = $_SERVER["HTTP_REFER ER"];
> //echo $ref;
> if ( $ref == 'http://www.mydomain.co m/gatepage.php' )
> {
> //record visit
> }
> else
> {
> //send to gatepage.php
> header("Locatio n:http://www.somegatepag e.com");
> exit;
> }
> ?>[/color]

The error "headers already sent" means that you've outputted content before
sending HTTP headers. Check your PHP script for whitespace before <?php etc.

By the way, HTTP_REFERER is not reliable for determining where a user come from
as for example firewalls can prevent that kind of information from being sent.
You could however check if the referer starts with http:// but isn't
http://www.mydomain.com/gatepage.php and then redirect them to the gateway page.

Regards,

Per Gustafson

**Gordon Burditt** · Jul 17 '05, 07:40 AM

Re: How to redirect based on $_SERVER["HTTP_REFE RER"]?

>I have a page that I don't want anyone to be able to link directly to. The[color=blue]
>page should only be accessed from gatepage.php. I tried this code, but keep
>getting errors - "header info already sent", or something like that... Am I
>missing something, or is there a better way to do this?[/color]

If you wish to send headers (such as Location:) you must output
them before outputting ANYTHING else. Including the blank line
before <?php . Or a single space. Or any debug output (that
echo $ref will BREAK your script if it's uncommented).[color=blue]
>[/color]
^^blank line (invisible but deadly)[color=blue]
><?php
>$ref = $_SERVER["HTTP_REFER ER"];
>//echo $ref;
>if ( $ref == 'http://www.mydomain.co m/gatepage.php' )
> {
> //record visit
> }
>else
> {
> //send to gatepage.php
> header("Locatio n:http://www.somegatepag e.com");
> exit;
> }
>?>[/color]

Incidentally, HTTP_REFERER is unreliable since it comes from the
user's browser. But it may be better than nothing. Or maybe not.
Lots of things filter HTTP_REFERER so it may break for users
who are trying to use gatepage.php .

Gordon L. Burditt

**steve** · Jul 17 '05, 07:40 AM

Re: How to redirect based on $_SERVER["HTTP_REFE RER"]?

"deko" wrote:[color=blue]
> I have a page that I don’t want anyone to be able to link
> directly to. The
> page should only be accessed from gatepage.php. I tried this code,
> but keep
> getting errors - "header info already sent", or something like[/color]
that...[color=blue]
> Am I
> missing something, or is there a better way to do this?
>
> <?php
> $ref = $_SERVER["HTTP_REFER ER"];
> //echo $ref;
> if ( $ref == ’http://www.mydomain.com/gatepage.php’ )
> {
> //record visit
> }
> else
> {
> //send to gatepage.php
> header("Locatio n:http://www.somegatepag e.com");
> exit;
> }
> ?>
>
> Thanks.[/color]

Deko, the problem you are experiencing relates to some header
information having been sent before you did the redirect. Easy to fix:
just cache all the output via ob_start (see php manual).

The other way, less recommended, is to use a javascript redirect.

--
http://www.dbForumz.com/ This article was posted by author's request
Articles individually checked for conformance to usenet standards
Topic URL: http://www.dbForumz.com/PHP-redirect...ict135845.html
Visit Topic URL to contact author (reg. req'd). Report abuse: http://www.dbForumz.com/eform.php?p=453690

**deko** · Jul 17 '05, 07:40 AM

Re: How to redirect based on $_SERVER["HTTP_REFE RER"]?

> By the way, HTTP_REFERER is not reliable for determining where a user come
from[color=blue]
> as for example firewalls can prevent that kind of information from being[/color]
sent.[color=blue]
> You could however check if the referer starts with http:// but isn't
> http://www.mydomain.com/gatepage.php and then redirect them to the gateway[/color]
page

Well, if HTTP_REFERER is unreliable, I may be asking for trouble. Perhaps
another option is to plant a cookie on the gateway page and then check for
it on the login page. This means the user's browser needs to be able to
process my cookie... do you think that's more reliable than HTTP_REFERER?

**deko** · Jul 17 '05, 07:40 AM

Re: How to redirect based on $_SERVER["HTTP_REFE RER"]?

> If you wish to send headers (such as Location:) you must output[color=blue]
> them before outputting ANYTHING else. Including the blank line
> before <?php . Or a single space. Or any debug output (that
> echo $ref will BREAK your script if it's uncommented).[/color]

Thanks for the tip - that was it...

**Tim Van Wassenhove** · Jul 17 '05, 07:40 AM

Re: How to redirect based on $_SERVER["HTTP_REFE RER"]?

In article <cTEPc.5757$AY5 .5484@newssvr21 .news.prodigy.c om>, deko wrote:[color=blue]
> I have a page that I don't want anyone to be able to link directly to. The
> page should only be accessed from gatepage.php. I tried this code, but keep
> getting errors - "header info already sent", or something like that... Am I
> missing something, or is there a better way to do this?[/color]

At gatepage.php you start a session, and you save the gatepage.php in
it. Now when the visitor moves on to foo.php you can check if
gatepage.php is in the session.

--
Tim Van Wassenhove <http://home.mysth.be/~timvw>

**deko** · Jul 17 '05, 07:40 AM

Re: How to redirect based on $_SERVER["HTTP_REFE RER"]?

> At gatepage.php you start a session, and you save the gatepage.php in[color=blue]
> it. Now when the visitor moves on to foo.php you can check if
> gatepage.php is in the session.[/color]

Sounds good. I'm new to php and have not yet used sessions. Time to
learn...

**Per Gustafsson** · Jul 17 '05, 07:40 AM

Re: How to redirect based on $_SERVER["HTTP_REFE RER"]?

deko wrote:[color=blue][color=green]
>>By the way, HTTP_REFERER is not reliable for determining where a user come[/color]
>
> from
>[color=green]
>>as for example firewalls can prevent that kind of information from being[/color]
>
> sent.
>[color=green]
>>You could however check if the referer starts with http:// but isn't
>>http://www.mydomain.com/gatepage.php and then redirect them to the gateway[/color]
>
> page
>
> Well, if HTTP_REFERER is unreliable, I may be asking for trouble. Perhaps
> another option is to plant a cookie on the gateway page and then check for
> it on the login page. This means the user's browser needs to be able to
> process my cookie... do you think that's more reliable than HTTP_REFERER?
>
>[/color]

You could eliminate the risk of locking out users (which I presume is what's
most important) by calculating some kind of checksum based on time and other
factors which aren't subject to change (HTTP_USER_AGEN T is, for intance, seldom
changed) and then redirect the user with that checksum in a GET variable.

You could also combine cookies and HTTP_REFERER so you'd have a fall-back if
cookies aren't enabled.

There's actually a few different approaches depending on what you want to
achieve, what's most important (to get all users in okey which comes from the
gateway or to prevent those coming from other pages from getting in) and so on.

/p

--

Per Gustafsson

http://www.pergustafsson.com/

**deko** · Jul 17 '05, 07:40 AM

Re: How to redirect based on $_SERVER["HTTP_REFE RER"]?

> There's actually a few different approaches depending on what you want to[color=blue]
> achieve, what's most important (to get all users in okey which comes from[/color]
the[color=blue]
> gateway or to prevent those coming from other pages from getting in) and[/color]
so on.

Someone suggested using a session. I thought I might explore that. Other
suggestion?

How to redirect based on $_SERVER["HTTP_REFERER"]?

How to redirect based on $_SERVER["HTTP_REFERER"]?

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment