Path: csiph.com!weretis.net!feeder4.news.weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: Thomas 'PointedEars' Lahn <PointedEars@web.de>
Newsgroups: comp.lang.php
Subject: Re: PHP processing steps to apply to a URL to make it safe
Date: Wed, 17 Feb 2016 23:36:32 +0100
Organization: PointedEars Software (PES)
Lines: 20
Message-ID: <5222750.81XvjZrRrl@PointedEars.de>
References: <na1es3$rsd$1@dont-email.me> <na1rs4$9tp$1@jstuckle.eternal-september.org> <na22l1$4u2$1@dont-email.me>
Reply-To: Thomas 'PointedEars' Lahn <php@PointedEars.de>
Mime-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7Bit
X-Trace: solani.org 1455748593 6515 eJwFwYEBwDAEBMCVKvxjnCD2H6F3UArbjaBhsX4vMhsaHRtptbrPy80n5p1TfJv8WCMiIH4laREj (17 Feb 2016 22:36:33 GMT)
X-Complaints-To: abuse@news.solani.org
NNTP-Posting-Date: Wed, 17 Feb 2016 22:36:33 +0000 (UTC)
User-Agent: KNode/4.14.2
X-User-ID: eJwFwYEBACAEBMCVIj7GSfz+I3TnG4J3DA5zOk/FPO0aqaksiu11dY5RBrkiRLWJCC5xZKdq2eXNUXvY/QFrPRXJ
Cancel-Lock: sha1:4aR13zKQatIZp7tRSf/2msIvIFM=
X-NNTP-Posting-Host: eJwFwYEBwCAIA7CXREql5wwm/59gEk5jHzCImBhDTVapXRsZOR/cf7s3uda2kcST6lIuWM0DE28Qjg==
Xref: csiph.com comp.lang.php:16479

James Harris wrote:

> On 17/02/2016 13:19, Jerry Stuckle wrote:
>> What are you actually trying to accomplish here?  I'm not sure how a
>> supplied URL will affect your PHP code.
> 
> At the moment I pick up $_SERVER["REQUEST_URI"]. That gives me the rest
> of the URL after the site:port part and does not strip off any ; or ?
> parts - which allows me to vet the URL including to ensure those parts
> are absent.
> 
> Does that make more sense now?

No, your approach is simply wrong.

-- 
PointedEars
Zend Certified PHP Engineer 
<http://www.zend.com/en/yellow-pages/ZEND024953> | Twitter: @PointedEars2
Please do not cc me. / Bitte keine Kopien per E-Mail.