Regarding what the guy before said. We've experienced problems where certain firewalls have encrypted the HTTP_REFERER meaning that it doesnt always contain the place you've come from.
Better to track where the user has come from either in a form post or in the url.