title: "NEVER Trust $_SERVER['HTTP_REFERER']" -- Why?
body: <p>I've heard it said over and over again that you should NEVER use <code>$_SERVER['HTTP_REFERER']</code>. <em>Why?</em> </p>
  
  <p>I understand that this can easily be manipulated by a user, i.e., that the variable can be set to anything that the user wants. Thus, I completely understand why it shouldn't be trusted from a security standpoint. But if e.g. all pages that should be viewable only by authed users recheck that the user is authed, where's the danger in relying on this variable? </p>