Thought I'd put a note about this as I spent ages rewriting an entire system.  The HTTP_REFERER environment variable can be changed by the user anyway but I was using it as an additional validation check.

The only solution is to not use it for verification purposes as it will only work in every other browser except Internet Explorer (more specifically versions 6 and 7...???)

For more details: http://www.webmaster-talk.com/php-forum/19149-_server-http_referer-fails-under-internet-explorer.html