Php security for entering location header via $ _GET

Question

I have this code on my page:

header ("Location: $ page");

The $ page is passed the script as a GET variable, do I need any security? (if so)

I was going to just use addlashes (), but that would fill the url ...

Answer 1

I, , , , ( www.yoursite.com?page=badsite.com). , badsite.com , , , .

$urls , :

$urls = array(
    'pageName1' => '/link/to/page/number/1',
    'pageNumber2' => '/link/to/page/number/2',
    'fancyPageName3' => '/link/to/page/number/3',
);
# Now your URL can look like this:
# www.yoursite.com?page=pageName1

Answer 2

. , , script - .

- - :

!

, , , . , ​​ PHP 4.4.2 5.1.2 , URI , . , ?page=%68%74%74%70%3a%2f%2f%65%76%69%6c%2e%65%78%61%6d%70%6c%65%2e%63%6f%6d%2f, URL- ?page=http://evil.example.com/.

Answer 3

, . , , , , . , , , , . :

$safe_pages = array('index.php', 'login.php', 'signup.php');
if (in_array($page, $safe_pages)) {
  header("Location: $page");
}
else {
  echo 'That page is not accessible.';
}

Answer 4

Or at least define a whitelist of allowed URLs and redirect the user only if the URL that they set is in the GET variable is in the list.