Any Security Concerns with REQUEST_URI

[cyberRobot]

Is there anything I need to be careful of with using REQUEST_URI?

 

 

I'm updating a login script so that it works with URLs that contain variables. What I want to do is create a variable:

$redirect = $_SERVER['REQUEST_URI'];

 

Then for the part which displays the login form as needed, I'll add the following code:

if($redirect != '') {
echo "<form method='post' name='form' action='$redirect'>";
} else {
echo "<form method='post' name='form' action='$_SERVER[php_SELF]'>";
}

//...display the rest of the form

 

 

Basically the $redirect variable will only be created for pages that require someone to be logged in before they can view the page content.

 

Also, the GET variables will be sanitized as needed after they log in.

[andrewgauger]

I apologize in advance if I'm wrong, but I thought that:

action = "" 

does the same thing.

[cyberRobot]

I apologize in advance if I'm wrong, but I thought that:

action = "" 

does the same thing.

 

 

I'm not sure what you mean? Are you asking why I'm using single quotes around the action attribute value (action='$redirect') instead of double quotes (action="$redirect")?

 

If so, I'm using single quotes because I'm already using double quotes around the entire <form> tag:

echo "<form method='post' name='form' action='$redirect'>";

 

I could use double quotes again, but I would need to escape them:

echo "<form method='post' name='form' action=\"$redirect\">";

[Mchl]

No. What he says is:

<form method='post' name='form' action=''>

Will use current URL as action.

[Kryptix]

Then for the part which displays the login form as needed, I'll add the following code:

if($redirect != '') {
echo "<form method='post' name='form' action='$redirect'>";
} else {
echo "<form method='post' name='form' action='$_SERVER[php_SELF]'>";
}

//...display the rest of the form

 

You could do the above in smaller code to:

 

echo "<form method=\"post\" name=\"form\" action=\" . (($redirect) ? $redirect : $_SERVER['PHP_SELF']) . "\">";

[cyberRobot]

Awesome, thanks andrewgauger and Mchl!

 

That makes the process so much simplier...now I don't need add variables everywhere. 

[Kryptix]

Also using just the below will post back to the same page as well, but I believe you need action for it to be valid XHTML.

 

<form method="post">

[cyberRobot]

Also using just the below will post back to the same page as well, but I believe you need action for it to be valid XHTML.

 

 

Yep, the action attribute is required to be valid XHTML.

[andrewgauger]

I wasn't sure if you were using a combo get/post and if the action="" would post back anything following the ?

[cyberRobot]

Everything appears to be working great.

 

I have however found that the solution doesn't work if the method attribute is set to 'get'.