HTTP_REFERER variable with PHP

When a web browser moves from one website to another and between pages of a website, it can optionally pass the URL it came from. This is called the HTTP_REFERER, and this post looks at how to use this variable with PHP.

Overview of http referers

Most web browsers pass the HTTP_REFERER variable by default, but in many this behaviour can be changed to not show it or to pass something else instead. There is also 3rd party anti-spyware etc software that can be installed on a user's computer which also prevents the referrer information from being passed to the web server. Because it can also be changed to something else, the HTTP_REFERER cannot be trusted, but it is still useful for working out where people have come from.

Appearance in log files

The following examples are from an Apache web server's log files.

The first example shows what a log entry looks like from someone coming from this website's homepage to this particular post. I have made the HTTP REFERER part of the log line bold (you'll need to scroll to the right to see it).

192.168.1.10 - - [16/Apr/2008:16:12:36 +1200] "GET /php-http-referer-variable/ HTTP/1.1" 200 2014 "http://www.electrictoolbox.com/" Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.8 (like Gecko)"

The second example shows the same thing, but because it is represented by a - only it tells us the user has either gone directly to that page by typing the address in or using a bookmark etc, or is masking the HTTP REFERER with a browser option or a 3rd party tool.

192.168.1.10 - - [16/Apr/2008:16:12:36 +1200] "GET /php-http-referer-variable/ HTTP/1.1" 200 2014 "-" Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.8 (like Gecko)"

Using HTTP_REFERER in PHP

The HTTP REFERER in PHP is stored in the $_SERVER super global, and can be referenced from anywhere in your PHP code like in the following example, which would simply write it out to the browser:

echo $_SERVER['HTTP_REFERER']

If the HTTP_REFERER has been set then it will be displayed. If it is not then you won't see anything. If it's not set and you have error reporting set to show notices, you'll see an error like this instead:

Notice: Undefined index: HTTP_REFERER in /path/to/filename.php on line 3

To prevent this error when notices are on (I always develop with notices on), you can do this:

if(isset($_SERVER['HTTP_REFERER']) {
    echo $_SERVER['HTTP_REFERER'];
}

Another way is like this:

echo isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '';

The use of the ? operator will return the first value after the ? if the condition is true and the second value if the condition is false. It can be useful to use when you are wanting to assign the value of the HTTP_REFERER to a variable. e.g.:

$referer = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '';

Conclusion

It can be useful to use the HTTP_REFERER variable for logging etc purposes using the $_SERVER['HTTP_REFERER'] superglobal variable. However it is important to know it's not always set so if you program with notices on then you'll need to allow for this in your code. The above examples show one way of doing this.