Sanitation for URL used in Header: Location?

问题:

In a multi-step form process, I am receiving a URL as a form field.

After processing, my PHP script redirects to that address using header("Location: ...");

Apart from the possibility of being misused as a redirect service for porn sites to generate harmless-looking links in E-Mails (Open Redirect, which can be helped by matching the URL to the local domain), are there any hacking / exploitation dangers to be aware of in this process?

One thing that came to mind was smuggling newlines into the URL, which might open the possibility of sending arbitrary headers to the client.

回答1:

In old versions of PHP you had to worry about CRLF injection which is \r\n. This is a "header response splitting vulnerability." If you strip out these characters then you shouldn't have to worry. In the latest build of of PHP the header() function is safe, and will automatically take care of \r\n for you.