Lesson: Creating a “Go Back” Button in PHP Without JavaScript Using HTTP_REFERER

Objective:

Learn how to create a functional “Go Back” button using PHP, relying on the HTTP_REFERER variable while ensuring its reliability through proper error handling and sanitization.

Prerequisites:

• Basic understanding of PHP
• Familiarity with HTML
• Awareness of server-side HTTP request headers

Introduction to HTTP_REFERER

The HTTP_REFERER variable in PHP, stored in the $_SERVER['HTTP_REFERER'] superglobal, holds the URL from which the user came before landing on the current page. This is particularly useful for creating a “Go Back” button without JavaScript, allowing the user to return to the previous page by clicking the button.

However, the HTTP_REFERER is unreliable because:

1. It can be modified or hidden by browsers or third-party software.
2. It is not always passed by the browser (e.g., when navigating from a bookmark or typing a URL directly).

Because of its limitations, it is important to sanitize and check if the HTTP_REFERER is set before using it in your PHP code.

Code to Create a Go Back Button Using HTTP_REFERER

1. Basic Approach Without Error Handling:

• This code attempts to display a link that directs the user to the previous page.
• The htmlspecialchars() function is used to prevent cross-site scripting (XSS) by encoding special characters in the URL.
• However, this code will throw an error if HTTP_REFERER is not set, which is why error handling is crucial.

2. Improved Code With Error Handling:

To avoid potential errors when HTTP_REFERER is unavailable, we can wrap the logic in a condition to check if it exists.

• Explanation:
  • We first check if $_SERVER['HTTP_REFERER'] is set using isset().
  • If it is set, we sanitize the URL using htmlspecialchars() to ensure it’s safe.
  • If not, we display a fallback message (like “No previous page found”).

3. Using Ternary Operator:

Alternatively, the ternary operator can be used for more concise code:

• • Explanation:
    • The ternary operator checks if $_SERVER['HTTP_REFERER'] is set. If it is, it assigns the sanitized URL to $url. Otherwise, it assigns an empty string.
    • We then either print the back link if $url has a value or a fallback message.

  Why Is HTTP_REFERER Unreliable?

  1. Browser Settings: Some browsers allow users to disable or modify the referrer information. In such cases, the HTTP_REFERER may be missing or incorrect.
  2. Privacy Tools: Many privacy-focused tools or plugins (such as anti-spyware) can block the referrer information from being sent.
  3. Direct Access: If a user directly accesses a page (e.g., via a bookmark or typing the URL), there is no referring page, and thus no HTTP_REFERER.

  Error Prevention in Logs

  When logging or analyzing server traffic, you may encounter cases where HTTP_REFERER is not set. Instead of causing errors, handle these situations gracefully by checking for its presence, as shown above.

  Here’s an example of a web server log that includes HTTP_REFERER:

However, in cases where HTTP_REFERER is blocked or not passed, it would look like this:

Conclusion

Using the HTTP_REFERER variable in PHP is useful for creating navigation aids like “Go Back” buttons, but always keep in mind its unreliability. By sanitizing the data and checking if it’s set, you can ensure your PHP application handles this scenario gracefully and securely.

Key Points:

• Always sanitize the HTTP_REFERER before using it.
• Check if HTTP_REFERER is set to avoid errors.
• Understand that HTTP_REFERER may be missing or altered due to user privacy settings or direct access.

Next Steps:

a. Add custom error messages or logging when HTTP_REFERER is unavailable.
b. Consider using server-side session management if navigation tracking is crucial for your application.

Related Videos:

Related Posts:

JavaScript Glossary

How to make a Go-Back Input button with inline JavaScript

What is Python?

How to create a constant in VB.NET?

What is the default value for Boolean variable in VB.NET?