Hash keys are case sensitive. $ENV{HTTP_referer} is not the same as $ENV{HTTP_REFERER} (unless you do some object-oriented or tied magic). Try capitalizing 'referer'.

Otherwise... are you using JavaScript to redirect the user to the script, or is it a client-side include sort of thing? This may be an example for XYZ Questions.