Question

I want to do a print on a argument that is on the URL, like this(in this case it’s Google):

http://bitoffapp.org/?http://google.com/

I want to get that and print it like this:

print("Go <a href='$url'>back</a> to the page you was before the login);

How can I do this?

Answer 1

$div = explode("?", $_SERVER['REQUEST_URI'], 2);
$arg = end($div);
//like Sarfraz says, you can also use directly $_SERVER['QUERY_STRING']

echo sprintf(
    'Go <a href="%s">back</a> to the page...',
    htmlspecialchars(urldecode($arg), ENT_QUOTES));

In practice, you’ll want to validate the URL to see

• If it’s indeed a valid URL (see FILTER_VALIDATE_URL)
• If you can find your site prefix there (checking for substr($url, 0, strlen($prefix)) === $prefix) is enough; $url is the urldecoded query string)

The reason for these checks is that otherwise attackers may trick your users into visiting URLs that, although prefixed with your domain, actually forward them to malicious websites or vulnerable registered protocols in the victim’s browser.