I need a script (PHP) that would block a user from viewing it unless
they came from a specific URL and no other.  (e.g., a user coming from
www.worldpay.com would be able to view it but a user coming from
google.com or anywhere else would not - and would be redirected to a
different page on my site.)

Hello thatonedude-ga 

Thank-you for your question.

In PHP you can determine where the user came from by the following line of code:

<? $referer = $_SERVER['HTTP_REFERER']; ?>

If you wish only the domain name they came from rather than the full
URL then you can use this:

<?
$referer = parse_url(htmlspecialchars(strip_tags($_SERVER['HTTP_REFERER'])));
?>

To redirect a user away from a page if they did not come from the
correct location you would place the following code at the start of
the page you did not wish them to see.  This must be placed before
*any* other code on the page.

<?
// get the page the user came from and store it in the variable $referer
$referer = parse_url(htmlspecialchars(strip_tags($_SERVER['HTTP_REFERER'])));

// if the variable $referer is not EXACTLY 
// equal to http://www.worldpay.com then 
// redirect them to http://foobar.com
if ( $referer != "http://www.worldpay.com" ) {
  header('Location: http://foobar.com/');
  exit;
};
?>

This is the basics that you require for this procedure.  You will need
to edit the above code to exactly fit your needs (that is where the
not wanted user is redirected to and what the $referer must match).

If you require any further information on this question please ask for
clarification and I will do my best to help.

---

Request for Answer Clarification by thatonedude-ga on 21 Aug 2005 14:16 PDT

I've placed this section of code at the beginning of my PHP page and I
changed the example URL in the code for my test:

<?
// get the page the user came from and store it in the variable $referer
$referer = parse_url(htmlspecialchars(strip_tags($_SERVER['HTTP_REFERER'])));

// if the variable $referer is not EXACTLY 
// equal to http://www.worldpay.com then 
// redirect them to http://foobar.com
if ( $referer != "http://www.testurl.com" ) {
  header('Location: http://www.differenturl.com');
  exit;
};
?>

However, it didn't matter if I was coming from the correct URL...the
content of the submit page was not displayed...I was redirected to the
"alternate" page.

Is there something else that I should be modifying?

Thank you!

---

Clarification of Answer by palitoy-ga on 21 Aug 2005 14:33 PDT

To help track down this error can you change the script slightly for me?

Please try this and let me know if what is printed out on the screen
is the URL you expect it to be:

<?
// get the page the user came from and store it in the variable $referer
$referer = parse_url(htmlspecialchars(strip_tags($_SERVER['HTTP_REFERER'])));

print $referer;
exit;

?>

To track the error down we first need to check that the server is
allowing you to access the referring page.

You should also be aware that your firewall may be blocking the
referring page value: http://karmak.org/2004/reftest/fix