You don't want to disturb it if it is already set: if (!isset($_SESSION['referer']) {
$_SESSION['referer'] = $_SERVER['HTTP_REFERER'];
}
But what if they are suppressing the referrer using browser options? Maybe ...
Links to login page (login.html):
login.html?referer=<?echo $_SERVER['SCRIPT_NAME']?>
then:
if (!isset($_SESSION['referer']) {
if ($_SERVER['HTTP_REFERER']) {
$_SESSION['referer'] = $_SERVER['HTTP_REFERER'];
}
else {
if (isset($_GET['referer'])) {
$_SESSION['referer'] = htmlspecialchars($_GET['referer']);
}
else {
$_SESSION['referer'] = "account.php";
}
}
}
BIG danger exposed by letting a $_GET parameter redirect a page, but since it is not persistent and only affects the one visitor, if they break it, they bought it. No harm done. Just make sure you test the parameter's value before you use it. I used htmlspecialchars() to do that in this example.
NOTE: I have included .html files in my PHP parsing by adding that extension to php.ini (or httpd.conf or wherever your MIME settings live). That's why I can use PHP on .html pages. The overhead of parsing all pages through the PHP engine is tiny, and I have never run into resource issues as a result of setting up a server this way. If you choose not to do that, then you would only be able to include PHP instructions on .php pages. Adjust to taste.
