title: How To Make PHP Only Process Variables Submitted From Same Server?
body: <p>I have this case :</p>
  
  <p>I have a file named form.php and it contains just simple HTML form with POST method and the 'action' file of that form always on different file, let's say : action.php. all of this scripts stored under a domain named : realdomain.com (just an example).</p>
  
  <p>today, I created a fake form from another domain (example : fakedomain.com), then I put this : <code>action="http://realdomain.com/action.php"</code> then hit the submit button and action.php on realdomain.com can't distinguish if it's from realdomain.com or fakedomain.com and let it goes through just like that...</p>
  
  <p>Then I have an idea to put some 'filter' on the action.php to ONLY process the variables submitted if the referred domain is realdomain.com using <code>$_SERVER['HTTP_REFERER']</code>. </p>
  
  <p>But again, in some forums or blog post, this method is not reliable at all since HTTP_REFERER can be faked too.</p>
  
  <p>So, how to validate this? I mean, how to make action.php ONLY process variables submitted from same server? </p>
  
  <p>thanks</p>