"if else", referer or what?

[pelachrum]

so I've set up this test script for detecting a referer.
and I just do not understand why it doesn't work

There are two snippets, this one prints my referer so I have something to check against as to what the server is thinking the referer really is:

<?php
$check = $_SERVER["HTTP_REFERER"];
echo "$check";
?>

and this one is supposed to display appropriate message ("yes" or "no") based on the referer:

<?php
if ($_SERVER["HTTP_REFERER"] = "http://www.mydomain.com/page.php")
echo "yes";
else
echo "no";
?>

what puzzles me is that if I arrive to the page holding this script from page.php, it gives me "yes" (the referer from the first script above also says [mydomain.com...] is good

but if I arrive from any other page it still says "yes"...? (yet the referer from first script is still correct showing me what other page I arrived from)

is there a problem with my if else statement or what, this does not make sense to me

[pelachrum]

sorry about the link there it did it automatically , it's not supposed to point to anywhere

[simon2263]

Your condition in the if-statement uses '=' which is the assignment operator, not '==' which is the equality comparison operator (as it should do).

Simon

[henry0]

What are you trying to achieve?

read the PHP manual [us2.php.net]
using HTTP_REFERER is not bullet proof

if you can use REQUEST_URI and PHP_SELF
you will have two values to check or match

for example
<?
$check=$SERVER['REQUEST_URI'];
echo "myreq_uri.$check";

if($_SERVER['PHP_SELF']="$check")
{
echo "yes"
}
else
{
echo "no";
}
?>

[pelachrum]

henry I will investigate this sollution and yes I did read about the referer being wacked

simon, you were right about the "=="

but let me take this subject in a bit different direction since after swapping == all seams to work (pending more tests that is)

I'm actually checking the referer for the home page (index.html)
I want "yes" if I arrive from the home page and "no" if I arrive from anywhere else
The problem now seams to be that comming from home page as in being typed in as www.mydomian.com in the address bar results in a referer being "http://www.mydomian.com/" but if came from the home page AFTER already visiting other pages prior to home page, the referer is "http://www.mydomian.com/index.html"
(if I code "yes" to appear for "http://www.mydomian.com/" it actually assumes all pages under the domain therefore "no" will never get to execute)

I don't know if I'm being clear here but basicly I need to either:
1. have a way for php to distinguish that "http://www.mydomian.com/" is only and only the same as "http://www.mydomian.com/index.html", not all pages under the domain, or
2. figures somethign out from the other end and have the home page always present itself as "http://www.mydomian.com/" (or "http://www.mydomian.com/index.html", whichever is actually possible) so that php does not get confused down the road

any thoughts on this dilemma?

[henry0]

I did not read further, need to go
but I did typed too fast (Shame :) )
Sorry
Henry

use ==

[pelachrum]

yeah == works but the issue I'm describing above is my current problem, I don't know how to make php tell a difference between www.mydomain.com (being the index.html - home page) and all pages under www.mydomain.com

[leadegroot]

Be aware that if you aren't working an intranet, or some other locked down config for your visitors, a good 30% will not send a referer.
I hate it, but they don't send it. :(
This will affect the success of your plans.

[pelachrum]

hmmmm that sucks....
I guess I'm gonna have to take the 70%

in my case nothing really horrible is going to happen, just a bit of an esthetical defficiency.

so is there a way for php to differentiate [domain.com...] from the domain as a whole site?

also a question... by saying "they don't send referer", is it about certain browsers not doing that or is it a config that can be set somewhere?
I'm asking in part because I'm wondering if there is a way to test such scenario, disable sending the referer to see how web page reacts...?

[pelachrum]

lol, this damn link again
this topic has nothing to do at all with domain.com obviously

[leadegroot]

Someone may edit to 'example.com' - won't make any difference to the meaning :)
The 30% was a gut-figure, from viewing logs, rather than anything I have carefully gathered stats on, btw
Its cross-browser - I have assumed it is part of the config of the pc, or possibly of some ISPs. Some don't send any referers for anything, so apart from IP and agent being the same, you can't actually show that eg logo.gif was loaded from eg index.html.
Some only dont send external referers - they just refuse to tell you where they come from.
I really hate it. I just want to know where my traffic is coming from...
So, you'll need to take it into account in your solution :(

[henry0]

You could ID each page
and pass the value as a SESSION
then check if it exists or if SESSION_IS_REGISTERED

[pelachrum]

yeah... the referer route seams buggy

session idea crossed my mind once but I guess I ignored it because of the small scale of my issue, again it's all just about esthetics and mixing sessions into this seamed like this oversized sollution

I am looking into it again though
how exactly do you go about it henry?

[henry0]

As of PHP4++
with register_global turned off in the PHP.ini
you could still use SESSON_IS_REGISTERED() with a string
Such as SESSION_IS_REGISTERED("my_page")

but let's try the regular SESSION and then use ISSET
if a session is created via a $_POST (form)
you will create the SESSION as follow
at the very top of your page add
session_start();
then we use the POST value

$my_page=$_POST['my_page'];
$_SESSION['my_page']=$my_page;
$my_page=$_SESSION['my_page'];

then to use the session wherever
again as always start by
session_start();
and then add
$my_page=$_SESSION['my_page'];

so now you may use the value $my_page all over the place!

Now without a $_POST
you may:
create a var for ex: $my_page="index.php";
then
$_SESSION['my_page']=$my_page;
there you have it
$my_page=$_SESSION['my_page'];

you can experiment around isset()
if (!isset($_SESSION['my_page']) )
{
do this
}
else
{
do that
)

or reverse it by using
if (isset($_SESSION etc.....

Review the manual
Session unset and destroy.

<edit>
You need to initialize the session in order to use it
if it is passed via a POST, no problem!

but if using the second solution you have to be sure that it will be created so for example if you set it on your index page it will always be "cranked on" since your user starts here or it will not be and then you might have the answer you are looking for.
</edit>