What are the potential issues with relying on $_SERVER["HTTP_REFERER"] to determine if a page was accessed through Facebook?

Potential issues with relying on $_SERVER["HTTP_REFERER"] to determine if a page was accessed through Facebook include the fact that the HTTP Referer header can be easily manipulated or spoofed by the user. To solve this issue, it is recommended to use a more reliable method such as checking for specific query parameters or using the Facebook PHP SDK to authenticate and verify the referral. 

if(isset($_GET['ref']) && $_GET['ref'] == 'facebook'){
    // Page was accessed through Facebook
    // Proceed with necessary actions
} else {
    // Page was not accessed through Facebook
    // Handle accordingly
}

Keywords

$_SERVER["HTTP_REFERER"] Facebook security validation spoofing

Related Questions