NYCPHP Meetup

[Joseph Crawford]

Guys,

I know that HTTP_REFERER is not always accurate or even set.  There
are also ways for people to fake that value.  I tend not to rely on
that much however what i need to do is this.

We have a file called spy.php that will return data to the browser if
the sitekey is found in our database.  This data is to be used by
members so they can show statistics on their site.  However to be sure
that it was the correct sitekey i was also checking the referer domain
against the domain stored in the database.  Is there a better way to
do this?  I do not want someone to be able to display the stats for
another site on theirs.

Is there a way to do this or should i just base it on the sitekey and
if it is valid return the stats for that particular site.  The sitekey
is an md5 hash.

Thanks,
-- 
Joseph Crawford Jr.
Zend Certified Engineer
Codebowl Solutions, Inc.
http://www.codebowl.com/
Blog: http://www.josephcrawford.com/
1-802-671-2021
codebowl at gmail.com