Is ['HTTP_REFERER'] dangerous, if I use a array of predefined URL's for validation?

[eric01]

Hey,

I am doing a login page for my application. When a user wants to go to "myaccount.php" but he's not logged in, he's redirected to login.php.

When login is successful, I want him to be redirected to $_SERVER['HTTP_REFERER'], which will be various pages of my application.

I read on forum that ['HTTP_REFERER'] can be dangerous.

But what if I create an array like ('myaccount.php','mycart.php', etc...) and compare this array to $_SERVER['HTTP_REFERER'], will this protect me against potential malicious use of this feature?

Cheers

[kristovaher]

Yes, comparing it against fixed list is perfectly safe.

But you should not use $_SERVER['HTTP_REFERER']. Not all browsers send this information.

Store the current URL ($_SERVER['REQUEST_URI']) in session, then direct the user to login page, then - if successful - redirect the user to the URL stored in the session.

[eric01]

Hi,
Thank you for your suggestion. I hadn't thought of using SESSION but this has solved the problem.

Cheers