What are the potential pitfalls when generating links in PHP and passing variables through URLs?

One potential pitfall when generating links in PHP and passing variables through URLs is the risk of injection attacks if user input is not properly sanitized. To prevent this, always validate and sanitize user input before including it in URLs. Additionally, make sure to properly encode the variables to prevent any special characters from causing issues. 

// Example of generating a link with sanitized user input
$userInput = $_GET['userInput']; // Assuming user input is coming from a form
$sanitizedInput = filter_var($userInput, FILTER_SANITIZE_STRING);

// Encode the variable before including it in the URL
$encodedInput = urlencode($sanitizedInput);

// Generate the link with the sanitized and encoded variable
$link = "example.com/page.php?input=" . $encodedInput;
echo "<a href='$link'>Link</a>";

Keywords

URL encoding security vulnerabilities XSS attacks PHP $_GET validation.

Related Questions