Question

I have:

<?php
$goto = $_GET['goto'];
?>

and:

<form method="get"><input type="text" name="goto" id="goTo" /></form>
<iframe id="page" src="http://<?php echo $goto; ?>"></iframe>

If I go to my page, nothing displays unless I end the URL with ?goto=<webadress>.

Example: http://example.com/windows8/apps/Flake/index.php?goto=http://google.com

How can I make it so that if the user didn’t type in ?goto=http://google.com, the page displays like a backup website?

Answer 1

If you want to provide a default value for $goto, do it like this:

<?php
$goto = !empty($_GET['goto']) ? $_GET['goto'] : 'http://www.google.com'; // default here
?>

However, you should be aware that by doing this, you allow everyone to construct URLs that point to your server but output to the browser HTML (and more importantly, scripts) that is not under your control (it comes from whatever URL goto points to). This would make it trivially easy for someone to attack your users.