Checking for XSS ?

[StinkFinger]

All,
Does the check below ensure that the files are originating from my server,
i.e. to prevent or detect
any type of XSS ? Or is the HTTP_HOST easily spoofed ?

function test ($refer)
{
if (!stristr($refer, $_SERVER["HTTP_HOST"])) {
die();
} else {
}
}

test ($_SERVER["HTTP_HOST"]);

Any better ideas ?
Many thanks.

[R. Rajesh Jeba Anbiah]

"StinkFinger" <st****@pinky.com> wrote in message news:<10*************@corp.supernews.com>...

All,
Does the check below ensure that the files are originating from my server,
i.e. to prevent or detect
any type of XSS ? Or is the HTTP_HOST easily spoofed ?

function test ($refer)
{
if (!stristr($refer, $_SERVER["HTTP_HOST"])) {
die();
} else {
}
}

test ($_SERVER["HTTP_HOST"]);

Any better ideas ?

Instead create a session variable in one page and see the presence
in another page (just like login mechanism)

--
| Just another PHP saint |
Email: rrjanbiah-at-Y!com