Restriction of Direct access in PHP - php

Question

I have a form page called form.php and when it is submitted it goes to step.php.
Now if users directly go to step.php it should go to error.php.
I tried a code but it also goes to error.php when user is redirected from `form.php'
The code which I tried:-
<?php
if ( $_SERVER['REQUEST_METHOD']=='GET' && realpath(__FILE__) == realpath( $_SERVER['SCRIPT_FILENAME'] ) ) {
header( 'HTTP/1.0 403 Forbidden', TRUE, 403 );
die( header( 'location: error.php' ) );
}
?>

Answer 1

You can use session to store information about form submit.
Place
session_start();
$_SESSION['was_on_form'] = 1;
on the top of form.php, and
session_start();
if (empty($_SESSION['was_on_form'])) {
// show error or make redirect
}
on the top of step.php
But usually it is not problem, that user visit step.php before form.php. In step.php you just validate $_POST form data and if data valid it is ok to proceed.

Answer 2

Solution 1
form.php
get the name of the button to submit to step.php
step.php
<?php
if(isset($_POST['btn_submit']))
{
// button submitted
}
else{
// button not submitted
}
?>
Solution 2
create a session on form.php with a unique value and store it as a hidden value
form.php
<?php
session_start();
$_SESSION['inputToken'] = rand(4 , 100); // you can generate a random string of your own rand() function is for numbers
$token = $_SESSION['inputToken'];
?>
<form>
<input type='hidden' name='_token' value='$token'/>
<input type='submit' name='btn_submit' value=''/>
</form>
step.php
<?php
session_start();
if(isset($_POST['btn_submit']) AND isset($_POST['_token']))
{
// check token if valid
if($_POST['_token'] == $_SESSION['inputToken'])
{
// submitted from the form
}
else{
// form was not submitted
header("location:form.php?msg=1");
}
}
else{
// button not submitted
header("location:form.php?msg=2");
}
?>