On Fri, 10 Sep 2004 19:25:01 +0000, usenet wrote:
> It seems that verifying $_SERVER['HTTP_REFERER'] should be enough to
> ensure that the script will only execute when called by the form on the
> site.
You should be aware that HTTP_REFERER could be easily faked. Perhaps you
could set a randomly-generated number in a cookie, and match that to the
client IP on the server side - though that might be a bit excessive.