What is the potential issue with using $_SERVER['HTTP_REFERER'] in PHP scripts?

Using $_SERVER['HTTP_REFERER'] in PHP scripts can be unreliable as it relies on the HTTP Referer header sent by the client, which can be easily manipulated or not sent at all. To mitigate this issue, it is recommended to validate and sanitize the referer value before using it in your script to prevent security vulnerabilities such as CSRF attacks. 

$referer = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : null;

if ($referer) {
    // Validate and sanitize the referer value before using it
    $referer = filter_var($referer, FILTER_SANITIZE_URL);
    
    // Your code logic here
} else {
    // Handle cases where the referer is not set
}

Keywords

$_SERVER['HTTP_REFERER'] security vulnerability cross-site request forgery user input data validation

Related Questions