http_referer

changing http_referer value?

[dragonangel]

Hi all

is there a way to change the http_referer to instead of what it was (for example www.mysite.com/file.php) to say - www.google.com by adding script to www.mysite.com/file.php?

Thanks in advance

[jatar_k]

possibly but I think we might need a little more explanation. You want the script to change it?

So you can trick a redirect or something? I don't really need to know what you are trying but what you want to change it and what needs to read the new one.

[dragonangel]

I'd like the script to change it so i can trick part of a script on the web (which I can't edit) to believe that i submitted a form from that website when I've submitted it from my own website.

Its an online form that sends an email to an address (for voting). The original url is: [theirsite.com...]
and the form wont submit unless the it was submitted from that site: [theirsite.com...]
My website is [mysite.com...] so the form obviously wont submit because its not the the correct http_referer
I want people who visit my site to be able to simply press one button to submit the form because I'd have hidden fields all filled in already so they dont have to bother.

hope that it cleared up a bit

[edited by: jatar_k at 4:45 pm (utc) on Oct. 3, 2003]
[edit reason] no urls thanks [/edit]

[MonkeeSage]

Hmmm...I tried this...

test.php

<?php 
 header("Referer: [milkdoes.a.body.good...]  
 echo '<a href="referer.php">Try it</a>'; 
?>

referer.php

<?php 
 echo "REFERRER = " . $_SERVER['HTTP_REFERER']; 
?>

...but for some reason it only(/always) shows...

REFERRER = [apache...]

I also tried the header() call in referer.php, but it made no difference.

Ps. "Referer: URI" is a valid header entry, I checked the specs [w3.org] to be sure.

Mabye they don't let you change it without turning on a setting somewhere (or not at all) because of the security risk or something?

Jordan

[jatar_k]

have you looked into using curl to do it?

CURL, Client URL Library Functions [ca.php.net]

[dragonangel]

Jordan I tried your idea anyhow and it still didn't work...

and jatar_k, I'm kind of a newbie when it comes to php so even thought i checked curl out it didn't really make much sense...and sorry bout the url thing

[psterling]

Any solutions to this problem? I've got the same problem, trying to use my own simplified interface for a real estate search engine. It works fine on my local computer (previewing with Dreamweaver), but it won't work once I upload it to the server (unless I don't clear my cache first). It seems maybe a short javascript coding on the submitting form might do the trick, if there is a way to set each viewer's referer variable to "" (null). The search engine works perfectly if I cut and paste the form results to the browser address bar...

[killroy]

http_referer is send by the program making the request, usually the browser. To set your own referer, you have to make hte request and adjust the code you use to do it.

So in case of makeing a POST form submission in code you'd send something like this to the server:

POST url HTTP/1.0
referer: fake_ref_url

POST-data&form=fields

Now most programming languages including PHP have functions that give you a neat interface to send this stuff, includign defining hte referer header field. I don't know PHP so I can't give you the code, but it should be avialable in hte documentation.

SN

[psterling]

I'm not familiar with PHP, but I'd definitely try to learn if that's what it comes down to... You're not talking about simply defnining a hidden variable named "referer" and submitting that along with the rest of the html form, are you? If so, I've tried, and it doesn't seem to work... Maybe you're talking about something entirely different, however...

[Dromar2003]

I have been trying to edit the referrer filed for such a long time. Ever since I first noticed advertisers not paying of clicks that came from my website cause they referrer was different. I even forced all clicks through a script to insure they came from my site, and still didn't get paid.

...anyways, I figured it out. I followed up on a suggestion posted my someone else, tested the script, and it works! =)

#
### testCURL.php
#
function GetCurlPage ($pageSpec)
{
if (function_exists('curl_init'))
{
$agent = "*cough* BULLSHIT *cough*";
$ref = "http://www.domain.com/UMM...DA REFERER";
$ch = curl_init($pageSpec);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_USERAGENT, $agent);
curl_setopt($ch, CURLOPT_REFERER, $ref);
$tmp = curl_exec($ch);
curl_close($ch);
$ret = $tmp;
}
else
{
$ret = @implode('', @file ($pageSpec));
}
return $ret;
}
print GetCurlPage('http://www.domain.com/checkCURL.php');
#
### checkCURL.php
#
print "<pre>\n";
print "\$HTTP_REFERER:  $HTTP_REFERER\n";
print "\$HTTP_USER_AGENT: $HTTP_USER_AGENT";

[psterling]

Thanks, DROMAR!

Just a little gentle nudging in the right direction, and I'm sure I'll get it. I talked with my website server guy last night, and unfortunately the only server-side stuff he can do with the current machine is ASP and ASP.net. He said he's about to switch our site over to his new box, which will offer much better/more services. As of yet, we don't have access to PHP, Perl, etc. BTW, it's a WIN2000 server. I knew we should've never switched hosts--just trying to be nice and help a friend, though!

Anyway, he says that he can install whatever software on the server that we need. That's my question: what do we need to run this script--and what would be good to have on there for other future scripts? PHP? I know he's NOT going to put Cold Fusion on.
---------------

Also, since I'm only familiar (somewhat) with Perl (used to use that for all scripts), what language is this script in? PHP? CURL? Any difference? I'll try my best to fill in all the variables to customize this script for my site. If you have a seciond, would you mind listing the VARs that I need to change?

Thanks!

-Philip

[psterling]

Is PHP standalone code, like Perl, or do I need to incorporate the above into an HTML document? Using Dreamweaver, I'm led to believe that I should just cut and paste the above into the body of HTML, but save it as .php...

[psterling]

Nevermind--I've now learned a good bit of PHP. It's remarkably similar to C, just easier (don't have to define variables, etc.)! PHP.net is a great site to get acquainted!

Anyone had any luck with the short program above? I can't get it to work properly. Regardless of what I do, it never seems to change the value of HTTP_REFERER properly...

[bcolflesh]

Do you have the CURL library installed? - the example code depends on it.