i wrote a php class that logs referers. it has a table of search engines and their query var, so if the referer is one of those engines, then the record goes into a 'search' table and it parses the query var and databases the search strings.
last week i wrote a c# windows app that displays the last 10 search strings and what engine it came from. since we get 1 or 2 hits per minute from search engines, it's kind of fun to watch sometimes.
i don't always have this logging feture enabled though since it affects performance a bit.
Although someone with nefarious intentions can always fake a referrer. I think the search engine check is good, but that keeps the honest spiders, honest.
Comparing the value of a hashed _something_ on each page seems like a good thing to have. Going further with a request token (as the php security page mentions) is also good, but takes more work.
Linear Mode
