How can the $_SERVER['HTTP_HOST'] variable affect the execution of the "header" function in PHP?

The $_SERVER['HTTP_HOST'] variable can affect the execution of the "header" function in PHP when used to set the "Location" header for redirects. If the value of $_SERVER['HTTP_HOST'] is not properly validated or sanitized, it can potentially be manipulated by an attacker to perform a redirect to a malicious website. To mitigate this risk, it is important to validate and sanitize the $_SERVER['HTTP_HOST'] variable before using it in the "header" function. 

// Validate and sanitize the $_SERVER['HTTP_HOST'] variable before using it in the header function
$validated_host = filter_var($_SERVER['HTTP_HOST'], FILTER_VALIDATE_URL);

// Perform the redirect using the validated and sanitized host
header("Location: https://" . $validated_host . "/new_page.php");
exit();

Keywords

$_SERVER['HTTP_HOST'] header function execution PHP variable

Related Questions