php - is $_SERVER['HTTP_REFERER'] safe?

Question

I'm using $_SERVER['HTTP_REFERER'] to generate a dynamic back link.

<a href="<?php echo $_SERVER['HTTP_REFERER'] ?>">Return to..blah</a>

Is it reasonably safe to do so?

Answer 1

Not like that.

It might not be present. (It might be wrong, some personal firewall packages obfuscate the referer for privacy reasons, violating the HTTP spec along the way)

You should run anything coming from outside your system through htmlspecialchars to guard against XSS attacks (although, IIRC, the referer should never have any dangerous characters in it as they should be URL safe you should keep in the habit of always being cautious).

Browsers come with back buttons though, there is no need to try to duplicate their functionality (especially when, with this, if the user clicks a link marked "back" it doesn't take them back in their history, so clicking the normal back button will conceptually take them forwards).