Is using $HTTP_REFERER a reliable method to track form submission origins in PHP?

Using $HTTP_REFERER to track form submission origins in PHP is not a reliable method as it can be easily manipulated or spoofed by the user. A more secure approach is to generate a unique token when rendering the form, store it in the session, and include it in the form submission. Upon form submission, you can compare the token value to verify the origin of the form. 

<?php
session_start();

// Generate a unique token
$token = md5(uniqid(rand(), true));
$_SESSION['form_token'] = $token;

// Include the token in the form
echo '<form method="post" action="submit_form.php">';
echo '<input type="hidden" name="form_token" value="' . $token . '">';
echo '<input type="text" name="name">';
echo '<input type="submit" value="Submit">';
echo '</form>';
?>

Keywords

$HTTP_REFERER form submission tracking origins reliability

Related Questions