Question

I found many way for redirect to previous page after login and example :

1. $_GET – need to validate
2. $_SESSION – will override the value if using multiple tabs
3. $_SERVER['HTTP_REFERER'] – it’s sent by the browser to the server

On form we can use

<form action="/process/?return=/previous/page/?id=123" method="post" />

or using hidden input.

<input type="hidden" name="return" value="$_GET or $_SESSION or $_SERVER" />

May I know what is the best practices to secure the return value?

Answer 1

The most common practice (also on e-commerce sites in payment checkout) is to have a hidden input with the URL to redirect to:

<input type="hidden" name="return" value="<?php echo($_SERVER['REQUEST_URI']); ?>" />

It seems to be secure enough for most people…