How to pass HTTP referrer to PHP script

Answer 1

You cannot "guess" this information from your show_widget.php script : clientsite will have to transmit that information to your script.

Which means your widget should be included with some code like this (provided the page on clientsite is generated in PHP) :

<script 
    type="text/javascript" 
    src="http://widgetserver.com/show_widget.php?referer=&lt;?php echo urlencode($_SERVER['HTTP_REFERER']); ?>>
</script>

Of course :

• don't forget to escape the referer while injecting it into the page, for security (and to get valid-HTML)
• the referer might not always be present : it is sent by the user's browser, and can be both faked and/or disabled.

To avoid a "Notice: Undefined index: HTTP_REFERER" from being generated/displayed when there is no referer sent by the user's browser, you might also want to add a check, to find out if it's defined before using it -- use isset for that ; for instance, something like this might do :

<script 
    type="text/javascript" 
    src="http://widgetserver.com/show_widget.php?referer=&lt;?php echo isset($_SERVER['HTTP_REFERER']) ? urlencode($_SERVER['HTTP_REFERER']) : ''; ?>>
</script>

Answer 2

You could detect the referred on the main script of clientside.com and pass it as a variable to your script:

// clientsite.com script
<?PHP

    echo $main_page;
    $ref = $_SERVER['HTTP_REFERER'];
    echo '<script type="text/javascript" ' .
      'src="http://widgetserver.com/show_widget.php?r=' . $ref . '></script>';

?>

// widgetserver.com script
<?PHP
    $original_referrer = $_REQUEST['r'];
?>

Answer 3

document.referrer contains the referrer information you want, so if they're running javascript, you could do something like this:

<script language="javascript" type="text/javascript">
var script = document.createElement("script");
script.src = "http://widgetserver.com/show_widget.php?r="+document.referrer;
document.getElementsByTagName("head")[0].appendChild(script);
</script>

This will need to go OUTSIDE of the head tag (unless it's in a function being bound to the document ready event or something), or it will fail.

The idea behind this is to generate a dynamic tag on the page with the attributes you want. The first line creates it, second line sets the script src, and the third page loads it into the document.head DOM element, which causes it to be evaluated, and loads the document as required.

If your clients are using jQuery, it is easier to use $.getScript, with a similar use of document.referrer