Can http_referer be spoofed

[Buddy Ackerman]

Is there a way to spoof the referer? One security measure that I want to
implement is checking to make sure that a request came from a page on my
site. In the same vein is it also possible to spoof the remote_host server
variable? Would using an encrypted cookie be the best way to secure data
being passed back and forth between the client and the server?

 

[Mr Carter]

Rule #1 Never trust anything you get from the user. All data is considered
harmful until it is validated.

ie Yes anyone can modify the header and post it back to you.

Encrypted cookie does not protect the data thats what SSL is for.

Hope that helps!