function check_referer(){
    global $_pages, $_base_href, $msg;
    if(isset($_SERVER['HTTP_REFERER']) && $_SERVER['HTTP_REFERER'] !='' && $_SERVER['HTTP_REFERER'] != $_SERVER['PHP_SELF']){
        $referer_script = preg_replace('#'.$_base_href.'#', '', $_SERVER['HTTP_REFERER']);
        if( !in_array($_pages[$referer_script], $_pages)){
			$msg->addError('ACCESS_DENIED');
			require(AT_INCLUDE_PATH.'header.inc.php'); 
			require(AT_INCLUDE_PATH.'footer.inc.php'); 
			exit;
        }
    }
}
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.