Sanitize user-supplied URL for file_get_contents
I want to use file_get_contents
to implement a proxy so I can do cross domain A开发者_StackOverflow中文版JAX requests.
Query string will be used to supply the URL to file_get_contents
. Now the problem is people can muck around with the query string in order to read local files on the server. I don't want this. Can someone get me a function to sanitize the query string in order to accept only URLs and not local files, i.e.:
?url=http://google.com.au
- OK?url=./passwords.txt
- Not OK
$url = filter_var($_GET['url'], FILTER_SANITIZE_URL);
or
if($_GET['url'] === filter_var($_GET['url'], FILTER_VALIDATE_URL)) {
... your stuff here ...
}
精彩评论