Horde::verifySignedQueryString PHP Method

    public static function verifySignedQueryString($data, $now = null)
    {
        if (is_null($now)) {
            $now = time();
        }
        $pos = strrpos($data, '&_h=');
        if ($pos === false) {
            return false;
        }
        $pos += 4;
        $queryString = substr($data, 0, $pos);
        $hmac = substr($data, $pos);
        if ($hmac != Horde_Url::uriB64Encode(hash_hmac('sha1', $queryString, $GLOBALS['conf']['secret_key'], true))) {
            return false;
        }
        // String was not tampered with; now validate timestamp
        parse_str($queryString, $values);
        return !($values['_t'] + $GLOBALS['conf']['urls']['hmac_lifetime'] * 60 < $now);
    }

<?php

/**
 * A script to redirect to a given URL, used to hide any referrer data being
 * passed to the remote server and potentially exposing any session IDs.
 *
 * Copyright 2003-2014 Horde LLC (http://www.horde.org/)
 *
 * See the enclosed file COPYING for license information (LGPL-2). If you
 * did not receive this file, see http://www.horde.org/licenses/lgpl.
 *
 * @author    Marko Djukic <*****@*****.**>
 * @category  Horde
 * @copyright 2003-2014 Horde LLC
 * @license   http://www.horde.org/licenses/lgpl LGPL-2
 * @package   Horde
 */
require_once __DIR__ . '/../lib/Application.php';
Horde_Registry::appInit('horde', array('authentication' => 'none', 'session_control' => 'none'));
if (strlen($url = trim($_GET['url'])) && !preg_match('/;\\s*url\\s*=/i', $url) && Horde::verifySignedQueryString($_SERVER['QUERY_STRING'])) {
    // URL verified -> so redirect
    header('Refresh: 0; URL=' . $url);
}