Quick PHP question about CGI environment variables

Discussion in 'NZ Computing' started by Adam Cameron, Sep 15, 2004.

  1. Adam Cameron

    Adam Cameron Guest

    G'day.
    If I do this in ColdFusion:

    structKeyExists(cgi, 'http_referer'): [#structKeyExists(cgi,
    'oompahloompah')#]<br />
    structKeyExists(cgi, 'oompahloompah'): [#structKeyExists(cgi,
    'oompahloompah')#]<br />

    Or this, in ASP:
    Request.ServerVariables("http_referer") : [<% Response.Write
    Request.ServerVariables("http_referer") %>]<br />
    Request.ServerVariables("oompahloompah") : [<% Response.Write
    Request.ServerVariables("oompahloompah") %>]<br />

    I get empty strings returned for both (or the correct referer, if there is
    one, obviously ;-)

    Now, I'd be keen for some kind person to tell me what they get if one does
    the equivalent thing in PHP? (and if anyone else who does other web-type
    languages out there wants to put their oar in, that'd be grand, too :)

    I have to say I'm no so concerned about the 'oompahloompah' side of things,
    just that I would expect the referer variable to *not exist* if there
    wasn't a referer value passed back from the HTTP server, not for it to be
    an empty string. I can see arguments both ways, and I'm not that fussed,
    I'm just interested in how other systems work.

    Cheers.

    Adam
     
    Adam Cameron, Sep 15, 2004
    #1
    1. Advertising

  2. Adam Cameron

    Harry.. Guest

    Adam Cameron wrote:

    > G'day.
    > If I do this in ColdFusion:
    >
    > structKeyExists(cgi, 'http_referer'): [#structKeyExists(cgi,
    > 'oompahloompah')#]<br />
    > structKeyExists(cgi, 'oompahloompah'): [#structKeyExists(cgi,
    > 'oompahloompah')#]<br />
    >
    > Or this, in ASP:
    > Request.ServerVariables("http_referer") : [<% Response.Write
    > Request.ServerVariables("http_referer") %>]<br />
    > Request.ServerVariables("oompahloompah") : [<% Response.Write
    > Request.ServerVariables("oompahloompah") %>]<br />
    >
    > I get empty strings returned for both (or the correct referer, if there is
    > one, obviously ;-)
    >
    > Now, I'd be keen for some kind person to tell me what they get if one does
    > the equivalent thing in PHP? (and if anyone else who does other web-type
    > languages out there wants to put their oar in, that'd be grand, too :)
    >
    > I have to say I'm no so concerned about the 'oompahloompah' side of
    > things, just that I would expect the referer variable to *not exist* if
    > there wasn't a referer value passed back from the HTTP server, not for it
    > to be
    > an empty string. I can see arguments both ways, and I'm not that fussed,
    > I'm just interested in how other systems work.
    >


    Apparently in PHP you just declare the usual cgi environment variables
    as global, and as with all environment variables a non-existent variable
    will be null as distinct from an empty string. But you might need to
    test that for yourself - might depend on your platform etc.

    PHP also has session.referer_check which will also make the distinction
    that you want.
     
    Harry.., Sep 16, 2004
    #2
    1. Advertising

  3. In article <1bvc91gehzpgq$> in nz.comp on
    Thu, 16 Sep 2004 10:49:20 +1200, Adam Cameron <>
    says...
    > G'day.
    > If I do this in ColdFusion:
    >
    > structKeyExists(cgi, 'http_referer'): [#structKeyExists(cgi,
    > 'oompahloompah')#]<br />
    > structKeyExists(cgi, 'oompahloompah'): [#structKeyExists(cgi,
    > 'oompahloompah')#]<br />
    >
    > Or this, in ASP:
    > Request.ServerVariables("http_referer") : [<% Response.Write
    > Request.ServerVariables("http_referer") %>]<br />
    > Request.ServerVariables("oompahloompah") : [<% Response.Write
    > Request.ServerVariables("oompahloompah") %>]<br />
    >
    > I get empty strings returned for both (or the correct referer, if there is
    > one, obviously ;-)
    >
    > Now, I'd be keen for some kind person to tell me what they get if one does
    > the equivalent thing in PHP? (and if anyone else who does other web-type
    > languages out there wants to put their oar in, that'd be grand, too :)


    It is still possible for that string to be cleared if there is no
    referer. It does work in PHP though as I have tried it.

    >
    > I have to say I'm no so concerned about the 'oompahloompah' side of things,
    > just that I would expect the referer variable to *not exist* if there
    > wasn't a referer value passed back from the HTTP server, not for it to be
    > an empty string. I can see arguments both ways, and I'm not that fussed,
    > I'm just interested in how other systems work.


    It depends on how your language of choice detects an empty variable,
    among other things

    If I reference $HTTP_REFERER in php I would expect to get an empty string
    even if there wasn't one, because of the way PHP works.
     
    Patrick Dunford, Sep 16, 2004
    #3
  4. In article <a642d.2917$> in nz.comp on Thu, 16
    Sep 2004 11:19:34 +1200, Harry.. <harry..@on..the.net> says...
    > Adam Cameron wrote:
    >
    > > G'day.
    > > If I do this in ColdFusion:
    > >
    > > structKeyExists(cgi, 'http_referer'): [#structKeyExists(cgi,
    > > 'oompahloompah')#]<br />
    > > structKeyExists(cgi, 'oompahloompah'): [#structKeyExists(cgi,
    > > 'oompahloompah')#]<br />
    > >
    > > Or this, in ASP:
    > > Request.ServerVariables("http_referer") : [<% Response.Write
    > > Request.ServerVariables("http_referer") %>]<br />
    > > Request.ServerVariables("oompahloompah") : [<% Response.Write
    > > Request.ServerVariables("oompahloompah") %>]<br />
    > >
    > > I get empty strings returned for both (or the correct referer, if there is
    > > one, obviously ;-)
    > >
    > > Now, I'd be keen for some kind person to tell me what they get if one does
    > > the equivalent thing in PHP? (and if anyone else who does other web-type
    > > languages out there wants to put their oar in, that'd be grand, too :)
    > >
    > > I have to say I'm no so concerned about the 'oompahloompah' side of
    > > things, just that I would expect the referer variable to *not exist* if
    > > there wasn't a referer value passed back from the HTTP server, not for it
    > > to be
    > > an empty string. I can see arguments both ways, and I'm not that fussed,
    > > I'm just interested in how other systems work.
    > >

    >
    > Apparently in PHP you just declare the usual cgi environment variables
    > as global, and as with all environment variables a non-existent variable
    > will be null as distinct from an empty string. But you might need to
    > test that for yourself - might depend on your platform etc.


    I presume if you test for null it will show as null, but if you treat it
    as a string it will look like an empty string, because of the automatic
    type conversion
     
    Patrick Dunford, Sep 16, 2004
    #4
  5. Adam Cameron

    Adam Cameron Guest

    > If I reference $HTTP_REFERER in php I would expect to get an empty string
    > even if there wasn't one, because of the way PHP works.


    So PHP won't error if you reference an undefined variable? Like, for
    example, if I tried to use $OOMPAHLOOMPAH without declaring or initialising
    it? Surely not. Or are you saying $HTTP_REFERER is always defined (just
    without a value)?

    Adam
     
    Adam Cameron, Sep 16, 2004
    #5
  6. In article <> in nz.comp on
    Thu, 16 Sep 2004 11:51:38 +1200, Adam Cameron <>
    says...
    > > If I reference $HTTP_REFERER in php I would expect to get an empty string
    > > even if there wasn't one, because of the way PHP works.

    >
    > So PHP won't error if you reference an undefined variable? Like, for
    > example, if I tried to use $OOMPAHLOOMPAH without declaring or initialising
    > it? Surely not. Or are you saying $HTTP_REFERER is always defined (just
    > without a value)?


    PHP does not require predeclaration of variable names. $HTTP_REFERER is
    just a variable name. The first time you reference it, if it doesn't
    already exist, PHP creates it. Obviously the server will set it up if
    there is something to put in it.

    isset tells you whether a variable exists or not. I tested it and it did
    work in my test script.

    How does http_referer get set anyway?
    Here's my test scripts:

    test0.php
    <?php
    header("Location: test1.php");
    ?>

    test1.php
    <?php
    if (isset($HTTP_REFERER) == FALSE)
    {
    echo ("Referrer does not exist<br>");
    }
    if (is_null($HTTP_REFERER) == TRUE)
    {
    echo ("Referrer null<br>");
    }
    echo $HTTP_REFERER;
    ?>

    doesn't set $HTTP_REFERER

    But
    test00.php
    <?php
    echo "<a href='test1.php'>test1.php</a>";
    ?>

    does work; it outputs the full URL of the script.
     
    Patrick Dunford, Sep 16, 2004
    #6
  7. Adam Cameron

    Chris Hope Guest

    Patrick Dunford wrote:

    > In article <> in nz.comp on
    > Thu, 16 Sep 2004 11:51:38 +1200, Adam Cameron <>
    > says...
    >> > If I reference $HTTP_REFERER in php I would expect to get an empty
    >> > string even if there wasn't one, because of the way PHP works.

    >>
    >> So PHP won't error if you reference an undefined variable? Like, for
    >> example, if I tried to use $OOMPAHLOOMPAH without declaring or
    >> initialising
    >> it? Surely not. Or are you saying $HTTP_REFERER is always defined (just
    >> without a value)?

    >
    > PHP does not require predeclaration of variable names. $HTTP_REFERER is
    > just a variable name. The first time you reference it, if it doesn't
    > already exist, PHP creates it. Obviously the server will set it up if
    > there is something to put in it.


    This isn't quite true, depending on your level of error reporting. Under a
    more strict error reporting level than most web servers have set up by
    default, you would get a warning message doing "print $foo;" if $foo had
    not already been assigned a value. However doing "$foo = 'bar';" then
    "print $foo;" would be ok.

    A lot of people who develop with PHP don't realise this because these
    warnings are usually supressed. I develop with the reporting level at 15
    (E_ERROR | E_WARNING | E_PARSE | E_NOTICE) so it shows all these warnings
    as well but have it at 7 (all those but without E_NOTICE) when in
    production. See http://nz.php.net/error_reporting for more info.

    --
    Chris Hope - The Electric Toolbox - http://www.electrictoolbox.com/
     
    Chris Hope, Sep 16, 2004
    #7
  8. In article <>,
    Patrick Dunford <> wrote:

    >If I reference $HTTP_REFERER in php...


    That should be $_SERVER["HTTP_REFERER"].
     
    Lawrence D¹Oliveiro, Sep 16, 2004
    #8
  9. In article <> in nz.comp on Fri,
    17 Sep 2004 10:24:07 +1200, Lawrence D¹Oliveiro <ldo@geek-
    central.gen.new_zealand> says...
    > In article <>,
    > Patrick Dunford <> wrote:
    >
    > >If I reference $HTTP_REFERER in php...

    >
    > That should be $_SERVER["HTTP_REFERER"].


    Can be both. The second format refers to an array structure, which also
    exists. I've verified that the first form works, but it may be version
    dependent.
     
    Patrick Dunford, Sep 16, 2004
    #9
  10. In article <>,
    Patrick Dunford <> wrote:

    >In article <> in nz.comp on Fri,
    >17 Sep 2004 10:24:07 +1200, Lawrence D1Oliveiro <ldo@geek-
    >central.gen.new zealand> says...
    >> In article <>,
    >> Patrick Dunford <> wrote:
    >>
    >> >If I reference $HTTP REFERER in php...

    >>
    >> That should be $ SERVER["HTTP REFERER"].

    >
    >Can be both.


    The former version is deprecated, because autoregistered globals lead to
    security risks. Set your php.ini to "register_globals = Off" today, and
    fix your scripts!

    Lawrence
    also not a fan of magic_quotes_gpc, but will rant about that another day
     
    Lawrence D¹Oliveiro, Sep 17, 2004
    #10
  11. In article <>,
    Patrick Dunford <> wrote:

    >PHP does not require predeclaration of variable names. $HTTP_REFERER is
    >just a variable name.


    Specifically, $HTTP_REFERER is a _global_ variable name. That means that
    if you reference it inside a function, you need to declare it, otherwise
    you won't get the right value.

    This is another advantage of $_SERVER["$HTTP_REFERER"]; $_SERVER is a
    "superglobal" which can be accessed anywhere without having to declare
    it.
     
    Lawrence D¹Oliveiro, Sep 19, 2004
    #11
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Technot So Saavy
    Replies:
    10
    Views:
    965
    Ron Martell
    Dec 20, 2004
  2. Replies:
    4
    Views:
    578
    Vintz
    May 2, 2007
  3. MF

    Re: Environment Variables

    MF, Jul 2, 2005, in forum: A+ Certification
    Replies:
    0
    Views:
    703
  4. raviraj joshi
    Replies:
    0
    Views:
    667
    raviraj joshi
    Jul 4, 2009
  5. Charlie Russel - MVP

    Environment variables

    Charlie Russel - MVP, Apr 4, 2010, in forum: Windows 64bit
    Replies:
    1
    Views:
    500
Loading...

Share This Page