You doesn't have a security problem in any case if you don't process the response of the server.
For example, when you use:
$url = 'http://www.example.com/testaddr';
$result = file_get_contents($url);
unset($result);
You have a variable with the data. But these data aren't processed yet.
With cURL, you can get the same approach with these options:
$url = 'http://www.example.com/testaddr';
$curl = curl_init();
curl_setopt ($curl, CURLOPT_URL, $url);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
$result = curl_exec($curl);
if (!curl_errno($curl)) {
$http_code = curl_getinfo($curl, CURLINFO_HTTP_CODE);
if ($http_code === 200) {
echo "OK";
} else {
echo 'Unexpected HTTP code: ', $http_code, "
";
}
}
curl_close($curl);
unset($result);
In that case it's the same, you get the response on $result var, but, you didn't use it, in that case, it isn't a security failure.
Also, in both cases, for security reasons and prevent excessive memory usage, I delete the $result variable after finish the process.
As you can see on PHP doc:
CURLOPT_RETURNTRANSFER TRUE to return the transfer as a string of the
return value of curl_exec() instead of outputting it out directly.