Are there potential security risks associated with using META HTTP-EQUIV="Refresh" for URL redirection in PHP?

Using META HTTP-EQUIV="Refresh" for URL redirection in PHP can pose security risks such as open redirect vulnerabilities, where an attacker can manipulate the redirection URL to direct users to malicious websites. To mitigate this risk, it is recommended to perform server-side URL validation and sanitization before using META HTTP-EQUIV="Refresh" for redirection. 

// Validate and sanitize the redirection URL
$redirectUrl = filter_var($_GET['redirect'], FILTER_SANITIZE_URL);

// Perform server-side validation to ensure the URL is safe
if (isValidUrl($redirectUrl)) {
    echo '<meta http-equiv="refresh" content="0;url=' . $redirectUrl . '">';
} else {
    // Redirect to a safe default URL if the provided URL is not valid
    header('Location: safe_default_url.php');
}

// Function to validate URL
function isValidUrl($url) {
    return filter_var($url, FILTER_VALIDATE_URL) !== false;
}

Keywords

META HTTP-EQUIV Refresh URL redirection security risks PHP

Related Questions