Php Redirect to query string

[gchristen]

Hi all.

I am a PHP beginner trying to get my head around this:

I would like to create a link on page A (a page on my website) that redirects to page C (external link) via page B (redirect.php).

For example, on page A, there is a link towards redirect.php?=www.cnn.com. When clicking this link, I want visitors to be redirected to www.cnn.com via redirect.php.

I am thinking of something in the line of

<?php
header('Location: $_SERVER['QUERY_STRING']);
?>

But I am not quite sure on the exact wording.

Many thanks

Glen

PS. the aim of this is to capture exit links on my virtual server host file.

[CyBerAliEn]

The dirtiest solution would be as follows...

Assuming you want your "link flow" as:
Page A (link) > Page B (redirect) > Page C (destination)

Links on Page A in form:

redirect.php?url=www.cnn.com

Then code on Page B could be:

<?php
$url = $_REQUEST['url'];
header("Location: http//{$url}");
exit();
?>

This will work. However, I would advise putting some further consideration to it.

Perhaps you could create a database table with columns: ID, identifier, url

Which could hold data like:

1, cnn, http//www.cnn.com
2, site, http//www.site.com
3, fun, http//www.fun.com
4, myarticle, http//www.writing.com/articles/123/
(etc)

Then, you could setup your links as 'redirect.php?to=cnn', 'redirect.php?to=site', etc. Or even skip the "identifier" column and use the ID number, such as 'redirect.php?to=1' or 'redirect.php?to=2', etc.

Then in your redirect.php file, the code would be more along the lines:

<?php
$to = $_REQUEST['to'];
/*run a query to get the URL from the database; assume the returned result is stored as an associative array named: $return */
header("Location: {$return['url']}");
exit();
/*and if the entry does not exist in the database, send an error message out, such as:*/
echo "Oops! Your request could not be processed.";
exit();
?>

The above is "pseudo-code". You would need to add code to do the database connection, query, etc.

There is nothing hugely wrong with the first/simple approach. But I like to know what is coming and going out of my programming. Keeping your 'redirect' open so that anyone could just enter a URL just feels like a possible hole for some type of exploitation.


This stupid forum keeps changing my text with 'http' in it to links... so I changed the text to stop it from doing this. Obviously, any URLs would contain the colon.

[gchristen]

Dear Cyberalien - man thanks for your reply!

You are right that someone could possibly exploit this, for example, by linking to illegal files using my domain name as the masking host. If I end up with only a few links on my website I might go for your second option. However, if the number of links keeps growing this might be too time consuming.

Once again, thank you very much for your efforts.