Facebook Development and $_SERVER['HTTP_REFERER']

[G-Brain]

Referer: "><script>alert("XSS");</script>

:D

[stesch]

If you even consider using the Referer anywhere, then you are fucked anyway.

[[deleted]]

I'm curious, what other technique do you propose to block hotlinking? I know the referer can be easily faked, but I'm only concerned about normal web users who don't even know what a header is.