3 ms·
Right, best to check the whole URL. Something like "http/../../../etc/passwd" might get through otherwise.
by nitrogen 10y ago
Right, best to check the whole URL. Something like "http/../../../etc/passwd" might get through otherwise.
- milankragujevic 10y agoLike.... $url = rawurldecode($_GET['url']); $url_without_protocol = str_replace(array('https://', 'http://'), '', $url); $protocol = (stristr($url, 'https://') ? 'https' : 'http'); $page = file_get_contents($protocol . '://' . $url_without_protocol);
- kh_hk 10y agoWhat about u = urlparse(url) if u.scheme not in ['http', 'https']: return 400