I have this very simple script that allows the user to specify the url of any site. The the script replaces the url of the ‘data’ attribute on an object tag to display the site of the users choice inside the object on the HTML page.
How could I validate the input so the user can’t load any page from my site inside the object because I have noticed that it will display my code.
The code:
<?php $url = 'http://www.google.com'; if (array_key_exists('_check', $_POST)) { $url = $_POST['url']; } //gets the title from the selected page $file = @ fopen(($url),'r') or die ('Can't read input stream'); $text = fread($file,16384); if (preg_match('/<title>(.*?)<\/title>/is',$text,$found)) { $title = $found[1]; } else { $title = 'Untitled Document'; } ?> Edit: (more details) This is NOT meant to be a proxy. I am letting the users decide which website is loaded into an object tag (similar to iframe). The only thing php is going to read is the title tag from the input url so it can be loaded into the title of my site. (Don’t worry its not to trick the user) Although it may display the title of any site, it will not bypass any filters in any other way.
I am also aware of vulnerabilities involved with what I am doing that’s why im looking into validation.
As gahooa said, I think you need to be very careful with what you’re doing here, because you’re playing with fire. It’s possible to do safely, but be very cautious with what you do with the data from the URL the user gives you.
For the specific problem you’re having though, I assume it happens if you get an input of a filename, so for example if someone types ‘index.php’ into the box. All you need to do is make sure that their URL starts with ‘http://’ so that fopen uses the network method, instead of opening a local file. Something like this before the fopen line should do the trick: