Path: csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: Arno Welzel <usenet@arnowelzel.de>
Newsgroups: comp.lang.php
Subject: Re: PHP processing steps to apply to a URL to make it safe
Date: Wed, 17 Feb 2016 19:14:19 +0100
Lines: 40
Message-ID: <56C4B87B.7090205@arnowelzel.de>
References: <na1es3$rsd$1@dont-email.me> <na1rs4$9tp$1@jstuckle.eternal-september.org> <na22l1$4u2$1@dont-email.me>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-Trace: individual.net ELBaJSNKSyB23NqgPjBrcgRc82r2GGs+WVOYThOwfclqulyHw8
Cancel-Lock: sha1:tVEMItQROeevX/lK+E2XX07FoPU=
In-Reply-To: <na22l1$4u2$1@dont-email.me>
Xref: csiph.com comp.lang.php:16470

James Harris schrieb am 2016-02-17 um 16:15:

> On 17/02/2016 13:19, Jerry Stuckle wrote:
> 
> ...
> 
>> What are you trying to "make safe"?  A url is either good or bad.  If
>> it's bad, it won't bring up a site.  If it's good, it will bring up a
>> site, but that site may not be safe.
> 
> In this case I use url rewriting to force requests to a PHP script. The 
> script then has to process the rest of the URL - basically all of the 
> URL after site:port.

For URL rewriting it is better to use the provided functions of your
webserver, e.g. Apache mod_rewrite etc..

>> What are you actually trying to accomplish here?  I'm not sure how a
>> supplied URL will affect your PHP code.
> 
> At the moment I pick up $_SERVER["REQUEST_URI"]. That gives me the rest 
> of the URL after the site:port part and does not strip off any ; or ? 
> parts - which allows me to vet the URL including to ensure those parts 
> are absent.
> 
> Does that make more sense now?

So - you want to take the REQUEST_URI, modify its contents and then use
the result to do another HTTP request or redirect?

In this case you should really think about using Apache rewriting. Or
does the "modify the requested URI" involve some local lookups to a
database etc.?


-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de
http://fahrradzukunft.de