showing a page based on http referrer

[Prodigal Son]

I set paypal donation button that sends them to a page with a message after they donate. I don't want anyone to just type in the url and be able to see this page, so I did this:

<?php
if (strpos($_SERVER['HTTP_REFERER'], "paypal.com"))
{
?>
<p>Message here</p>
<?php
}
else
{
header('location: /404error/');
}
?>

I got a friend to test it and it didn't work. After he donated it went to the 404 page instead of the page with the message. Did I mess up something, is there a better way to do it than this?

[The Little Guy]

<?php
if (preg_match("/paypal.com/",$_SERVER['HTTP_REFERER']))
{
?>



<p>Message here</p>
<?php
}
else
{



header('location: /404error/');
}
?>

[Prodigal Son]

Hmm, still doesn't work. Could it not be a problem with the code and that paypal somehow doesn't let you receive the referer? Would there be another way to do this?

[The Little Guy]

to check what is sent back do this:

 

echo '<pre>';
print_r($_SERVER);
echo '</pre>';

[DarkWater]

Also, not all browsers set the referrer and it can be tampered with.  Don't rely on it.

[Prodigal Son]

to check what is sent back do this:

 

echo '<pre>';
print_r($_SERVER);
echo '</pre>';

Ok I saw all the server variables, I couldn't find HTTP_REFERER in the list, so I guess it was blank.

 

Also, not all browsers set the referrer and it can be tampered with.  Don't rely on it.

Hmm, so is there another way to do this?

[DarkWater]

You could link the Paypal button to a PHP script that sets a session variable and then sends them off to Paypal. >_>

[Prodigal Son]

You could link the Paypal button to a PHP script that sets a session variable and then sends them off to Paypal. >_>

Hmm, how would I do that? Or maybe I can also create a cookie with a JS onclick and check if the cookie exists? But even if you did that, it only means after they clicked on the button they can see the page. They could just click it and even if they don't donate they can see the page if they know the url. Actually there's nothing really important on that page, I don't even know why I care lol, maybe I should just leave it public?