Women in Technology

Hear us Roar

Article:		Ten Security Checks for PHP, Part 1
Subject:		Register Globals on
Date:		2007-03-01 11:52:54
From:		andrwe
Response to: Register Globals on
My method for securing where POST data comes from is thus: $referer = $_SERVER['HTTP_REFERER']; if ($referer != "http://www.domain.com/form.html") { echo "nice try!"; } else { process_form(); } Any downside to that (other than having to change the URL upon upload)?

Showing messages 1 through 2 of 2.

Register Globals on
2008-07-01 11:13:49 davidrrm [View]

That's certainly not a certain test though. I could create a program to do the post and it would set HTTP_REFERER to what you are looking for.