Posted by Toby A Inkster on 05/14/07 09:08

Martien van Wanrooij wrote:

> In a simple webshop application I am trying to check that the "shopping
> cart" only should be "filled" when you choose an article in "meerinfo.php"
> and click on a link to "winkelwagen.php". It works fine in that sense that
> when I would enter in the browser "www.mysite.php/winkelwagen?id=5"it will
> be ignored.

Don't use HTTP Referer checking like this. It's an optional HTTP header,
and some browsers do not send it; and some proxies filter it out, or send
fake referers.

If you really want to force users to go via page X to get to page Y, then
use sessions -- that's what they're there for.

--
Toby A Inkster BSc (Hons) ARCS
http://tobyinkster.co.uk/
Geek of ~ HTML/SQL/Perl/PHP/Python/Apache/Linux

[Back to original message]