Question

I have a simple function for checking the web site title:

$doc = new DOMDocument();
@$doc->loadHTMLFile($aUrl);
$xpath = new DOMXPath($doc);     

if(!isset($xpath->query('//title')->item(0)->nodeValue)) 
{             
     return FALSE;
}                              

return $xpath->query('//title')->item(0)->nodeValue;  

But if the user pass the localhost or 127.0.0.1, they can get my host data, I can make a simple guide to allow user input these value, but sometimes, I can’t ensure the internal ip, like 192.168.11.2, how can I protect the site won’t query back my host? Thank you.

Answer 1

add this line to begining

if( preg_match( "/^(http:\/\/)(localhost|127.0.0.1|{$_SERVER["SERVER_ADDR"]}|{$_SERVER["HTTP_HOST"]}|www.yourhost.net)/i", $aUrl )) die( 'error' );

it may help