What are the potential security risks of directly appending user input to a URL in PHP?

Appending user input directly to a URL in PHP can lead to security risks such as SQL injection, cross-site scripting (XSS), and other vulnerabilities. To prevent these risks, it is important to properly sanitize and validate user input before appending it to a URL. 

// Sanitize and validate user input before appending it to a URL
$user_input = $_GET['user_input']; // Assume user_input is coming from the GET request

// Sanitize user input to prevent SQL injection and XSS attacks
$sanitized_input = htmlspecialchars(strip_tags($user_input));

// Validate user input to ensure it meets specific criteria
if (/* validation criteria */) {
    // Append the sanitized input to the URL
    $url = "http://example.com/?param=" . urlencode($sanitized_input);
    
    // Redirect to the sanitized URL
    header("Location: $url");
    exit();
} else {
    // Handle invalid input
    echo "Invalid input";
}

Keywords

SQL injection cross-site scripting URL manipulation data validation input sanitization

Related Questions