通过$ _GET注册位置标头的php安全性

Question

I've got this code on my page:

header("Location: $page");

$page is passed to the script as a GET variable, do I need any security? (if so what)

I was going to just use addslashes() but that would stuff up the URL...

Answer 1

I could forward your users anywhere I like if I get them to click a link, which is definitely a big security flaw (Please login on www.yoursite.com?page=badsite.com). Now think of a scenario where badsite.com looks exactly like your site, except that it catches your user's credentials.

You're better off defining a $urls array in your code and passing only the index to an entry in that array, for example:

$urls = array(
    'pageName1' => '/link/to/page/number/1',
    'pageNumber2' => '/link/to/page/number/2',
    'fancyPageName3' => '/link/to/page/number/3',
);
# Now your URL can look like this:
# www.yoursite.com?page=pageName1