«

G'day.
If I do this in ColdFusion:

structKeyExists(cgi, 'http_referer'): [#structKeyExists(cgi,
'oompahloompah')#]<br />
structKeyExists(cgi, 'oompahloompah'): [#structKeyExists(cgi,
'oompahloompah')#]<br />

Or this, in ASP:
Request.ServerVariables("http_referer") : [<% Response.Write
Request.ServerVariables("http_referer") %>]<br />
Request.ServerVariables("oompahloompah") : [<% Response.Write
Request.ServerVariables("oompahloompah") %>]<br />

I get empty strings returned for both (or the correct referer, if there is
one, obviously

Now, I'd be keen for some kind person to tell me what they get if one does
the equivalent thing in PHP? (and if anyone else who does other web-type
languages out there wants to put their oar in, that'd be grand, too

I have to say I'm no so concerned about the 'oompahloompah' side of things,
just that I would expect the referer variable to *not exist* if there
wasn't a referer value passed back from the HTTP server, not for it to be
an empty string. I can see arguments both ways, and I'm not that fussed,
I'm just interested in how other systems work.

Cheers.

Adam

Adam Cameron wrote:

> G'day.
> If I do this in ColdFusion:
>
> structKeyExists(cgi, 'http_referer'): [#structKeyExists(cgi,
> 'oompahloompah')#]<br />
> structKeyExists(cgi, 'oompahloompah'): [#structKeyExists(cgi,
> 'oompahloompah')#]<br />
>
> Or this, in ASP:
> Request.ServerVariables("http_referer") : [<% Response.Write
> Request.ServerVariables("http_referer") %>]<br />
> Request.ServerVariables("oompahloompah") : [<% Response.Write
> Request.ServerVariables("oompahloompah") %>]<br />
>
> I get empty strings returned for both (or the correct referer, if there is
> one, obviously
>
> Now, I'd be keen for some kind person to tell me what they get if one does
> the equivalent thing in PHP? (and if anyone else who does other web-type
> languages out there wants to put their oar in, that'd be grand, too
>
> I have to say I'm no so concerned about the 'oompahloompah' side of
> things, just that I would expect the referer variable to *not exist* if
> there wasn't a referer value passed back from the HTTP server, not for it
> to be
> an empty string. I can see arguments both ways, and I'm not that fussed,
> I'm just interested in how other systems work.
>

Apparently in PHP you just declare the usual cgi environment variables
as global, and as with all environment variables a non-existent variable
will be null as distinct from an empty string. But you might need to
test that for yourself - might depend on your platform etc.

PHP also has session.referer_check which will also make the distinction
that you want.

In article <1bvc91gehzpgq$.> in nz.comp on
Thu, 16 Sep 2004 10:49:20 +1200, Adam Cameron <>
says...
> G'day.
> If I do this in ColdFusion:
>
> structKeyExists(cgi, 'http_referer'): [#structKeyExists(cgi,
> 'oompahloompah')#]<br />
> structKeyExists(cgi, 'oompahloompah'): [#structKeyExists(cgi,
> 'oompahloompah')#]<br />
>
> Or this, in ASP:
> Request.ServerVariables("http_referer") : [<% Response.Write
> Request.ServerVariables("http_referer") %>]<br />
> Request.ServerVariables("oompahloompah") : [<% Response.Write
> Request.ServerVariables("oompahloompah") %>]<br />
>
> I get empty strings returned for both (or the correct referer, if there is
> one, obviously
>
> Now, I'd be keen for some kind person to tell me what they get if one does
> the equivalent thing in PHP? (and if anyone else who does other web-type
> languages out there wants to put their oar in, that'd be grand, too

It is still possible for that string to be cleared if there is no
referer. It does work in PHP though as I have tried it.

>
> I have to say I'm no so concerned about the 'oompahloompah' side of things,
> just that I would expect the referer variable to *not exist* if there
> wasn't a referer value passed back from the HTTP server, not for it to be
> an empty string. I can see arguments both ways, and I'm not that fussed,
> I'm just interested in how other systems work.

It depends on how your language of choice detects an empty variable,
among other things

If I reference $HTTP_REFERER in php I would expect to get an empty string
even if there wasn't one, because of the way PHP works.

In article <a642d.2917$> in nz.comp on Thu, 16
Sep 2004 11:19:34 +1200, Harry.. <harry..@on..the.net> says...
> Adam Cameron wrote:
>
> > G'day.
> > If I do this in ColdFusion:
> >
> > structKeyExists(cgi, 'http_referer'): [#structKeyExists(cgi,
> > 'oompahloompah')#]<br />
> > structKeyExists(cgi, 'oompahloompah'): [#structKeyExists(cgi,
> > 'oompahloompah')#]<br />
> >
> > Or this, in ASP:
> > Request.ServerVariables("http_referer") : [<% Response.Write
> > Request.ServerVariables("http_referer") %>]<br />
> > Request.ServerVariables("oompahloompah") : [<% Response.Write
> > Request.ServerVariables("oompahloompah") %>]<br />
> >
> > I get empty strings returned for both (or the correct referer, if there is
> > one, obviously
> >
> > Now, I'd be keen for some kind person to tell me what they get if one does
> > the equivalent thing in PHP? (and if anyone else who does other web-type
> > languages out there wants to put their oar in, that'd be grand, too
> >
> > I have to say I'm no so concerned about the 'oompahloompah' side of
> > things, just that I would expect the referer variable to *not exist* if
> > there wasn't a referer value passed back from the HTTP server, not for it
> > to be
> > an empty string. I can see arguments both ways, and I'm not that fussed,
> > I'm just interested in how other systems work.
> >
>
> Apparently in PHP you just declare the usual cgi environment variables
> as global, and as with all environment variables a non-existent variable
> will be null as distinct from an empty string. But you might need to
> test that for yourself - might depend on your platform etc.

I presume if you test for null it will show as null, but if you treat it
as a string it will look like an empty string, because of the automatic
type conversion

> If I reference $HTTP_REFERER in php I would expect to get an empty string
> even if there wasn't one, because of the way PHP works.

So PHP won't error if you reference an undefined variable? Like, for
example, if I tried to use $OOMPAHLOOMPAH without declaring or initialising
it? Surely not. Or are you saying $HTTP_REFERER is always defined (just
without a value)?

Adam

In article <> in nz.comp on
Thu, 16 Sep 2004 11:51:38 +1200, Adam Cameron <>
says...
> > If I reference $HTTP_REFERER in php I would expect to get an empty string
> > even if there wasn't one, because of the way PHP works.
>
> So PHP won't error if you reference an undefined variable? Like, for
> example, if I tried to use $OOMPAHLOOMPAH without declaring or initialising
> it? Surely not. Or are you saying $HTTP_REFERER is always defined (just
> without a value)?

PHP does not require predeclaration of variable names. $HTTP_REFERER is
just a variable name. The first time you reference it, if it doesn't
already exist, PHP creates it. Obviously the server will set it up if
there is something to put in it.

isset tells you whether a variable exists or not. I tested it and it did
work in my test script.

How does http_referer get set anyway?
Here's my test scripts:

test0.php
<?php
header("Location: test1.php");
?>

test1.php
<?php
if (isset($HTTP_REFERER) == FALSE)
{
echo ("Referrer does not exist<br>");
}
if (is_null($HTTP_REFERER) == TRUE)
{
echo ("Referrer null<br>");
}
echo $HTTP_REFERER;
?>

doesn't set $HTTP_REFERER

But
test00.php
<?php
echo "<a href='test1.php'>test1.php</a>";
?>

does work; it outputs the full URL of the script.

Patrick Dunford wrote:

> In article <> in nz.comp on
> Thu, 16 Sep 2004 11:51:38 +1200, Adam Cameron <>
> says...
>> > If I reference $HTTP_REFERER in php I would expect to get an empty
>> > string even if there wasn't one, because of the way PHP works.
>>
>> So PHP won't error if you reference an undefined variable? Like, for
>> example, if I tried to use $OOMPAHLOOMPAH without declaring or
>> initialising
>> it? Surely not. Or are you saying $HTTP_REFERER is always defined (just
>> without a value)?
>
> PHP does not require predeclaration of variable names. $HTTP_REFERER is
> just a variable name. The first time you reference it, if it doesn't
> already exist, PHP creates it. Obviously the server will set it up if
> there is something to put in it.

This isn't quite true, depending on your level of error reporting. Under a
more strict error reporting level than most web servers have set up by
default, you would get a warning message doing "print $foo;" if $foo had
not already been assigned a value. However doing "$foo = 'bar';" then
"print $foo;" would be ok.

A lot of people who develop with PHP don't realise this because these
warnings are usually supressed. I develop with the reporting level at 15
(E_ERROR | E_WARNING | E_PARSE | E_NOTICE) so it shows all these warnings
as well but have it at 7 (all those but without E_NOTICE) when in
production. See http://nz.php.net/error_reporting for more info.

--
Chris Hope - The Electric Toolbox - http://www.electrictoolbox.com/

In article < >,
Patrick Dunford <> wrote:

>If I reference $HTTP_REFERER in php...

That should be $_SERVER["HTTP_REFERER"].

In article <ldo-> in nz.comp on Fri,
17 Sep 2004 10:24:07 +1200, Lawrence D¹Oliveiro <ldo@geek-
central.gen.new_zealand> says...
> In article < >,
> Patrick Dunford <> wrote:
>
> >If I reference $HTTP_REFERER in php...
>
> That should be $_SERVER["HTTP_REFERER"].

Can be both. The second format refers to an array structure, which also
exists. I've verified that the first form works, but it may be version
dependent.

In article < >,
Patrick Dunford <> wrote:

>In article <ldo-> in nz.comp on Fri,
>17 Sep 2004 10:24:07 +1200, Lawrence D1Oliveiro <ldo@geek-
>central.gen.new zealand> says...
>> In article < >,
>> Patrick Dunford <> wrote:
>>
>> >If I reference $HTTP REFERER in php...
>>
>> That should be $ SERVER["HTTP REFERER"].
>
>Can be both.

The former version is deprecated, because autoregistered globals lead to
security risks. Set your php.ini to "register_globals = Off" today, and
fix your scripts!

Lawrence
also not a fan of magic_quotes_gpc, but will rant about that another day