How would you redirect a redirect?

dealspecialist

Hi,

I was using

header('Location: ' . $_GET['url']);

in a page to do my redirects, however it appears that when I have parameters being passed by the variable url, all the parameters are being ignored, due to the "&". Does anyone have a way I can work around this?

thanks i advance,
dealspecialist

edit (more info)

http://www.mysite.com/goto.php?url=http://www.destinationsite.com?param=1&param2=2&param3=3

My www.mysite.com is passing params url=http://www.destinationsite.com?param=1, param2=2, and param3=3 (not my intention)

...and goto.php is only getting http://www.destinationsite.com?param=1 as the url.

konsu

try to add the parameters to the redirect location.

kburger

I think if you encode the 'url' parameter with htmlspecialchars() before posting it to the form handler your problem will be solved, but I haven't tested it. And I don't think it's the '?' in the 'url', but it's probably any '&' characters.

dealspecialist

konsu wrote:
try to add the parameters to the redirect location.

I'm grabbing the redirect from and external source so I can't add them separately.

dealspecialist

kburger wrote:
I think if you encode the 'url' parameter with htmlspecialchars() before posting it to the form handler your problem will be solved, but I haven't tested it. And I don't think it's the '?' in the 'url', but it's probably any '&' characters.

I'll give that a try

update
just tried it. it doesn't work. Turns out it is the "&" that is the problem though.

kburger

Instead of htmlspecialchars(), try this:

$url = str_replace("&", "%26", $url);

dealspecialist

kburger wrote:
Instead of htmlspecialchars(), try this:
$url = str_replace("&", "%26", $url);

I think I've pinpointed the problem, but still not sure how to solve.

Page is being called like this:

http://www.mysite.com/goto.php?url=http://www.destinationsite.com?param=1&param2=2&param3=3

My www.mysite.com is passing params url=http://www.destinationsite.com?param=1, param2=2, and param3=3 (not my intention)

...and goto.php is only getting http://www.destinationsite.com?param=1 as the url.

konsu

page is being called incorrectly, any special characters such as &, etc. need to be url-encoded in the url's query string.

kburger

So you want your header line to be this, right?

header("Location: http://www.destinationsite.com?param=1&param2=2&param3=3");

If you've used str_replace to replace & with %26 you'll need to convert it back using

$url = str_replace("%26", "&", $_GET['url']);

After doing that just echo $url out and see what you get. It should be what's above. If not, let me know what it is.

edit: urlencode() Thanks konsu. That's what I was trying to think of.

konsu

kburger wrote:
So you want your header line to be this, right?
header("Location: http://www.destinationsite.com?param=1&param2=2&param3=3");
If you've used str_replace to replace & with %26 you'll need to convert it back using
$url = str_replace("%26", "&", $_GET['url']);
After doing that just echo $url out and see what you get. It should be what's above. If not, let me know what it is.

edit: urlencode() Thanks konsu. That's what I was trying to think of.

it appears that no matter what his code does, he will always get only param1 in $_GET['url'] because whoever calls his page did not url-encode the contents of the 'url' query string parameter. there is nothing that can be done to recover from that but to change the calling code.

kburger

If that's the case you may have to get at the query string and parse it yourself. You should be able to get the query string with $_SERVER['QUERY_STRING'].

dealspecialist

Thanks kburger and konsu 😃

I got it working with the following code:

<?php
$theurl = $_SERVER['QUERY_STRING'];
$theurl = str_replace("url=", "", $theurl);
header('Location: ' . $theurl);
?>

ryneaux

You could try this...

$myredirect=explode("?",$HTTP_REQUEST_URI);
$redirect=str_replace("url=","",$myredirect[1]);
$redirect.=$myredirect[2];
Header("Location:".$redirect);

Drakla

Has this been solved now, because bizarrely my very first php contract was a bundle of writing an XML parser and creating a jump script to solve the very same problem as this. Brings a tear to the eye, it does.

$url = @$_GET['url'];

foreach($_GET as $key=>$val)
{
	if($key!='url')
	{
		$val = urlencode($val);
		$url.= "&$key=$val";
	}
}

Think that's worth £250 - no, neither did I - rah!

konsu

note that this solution, as well, as the one that uses $_SERVER['QUERY_STRING'] will work only if the caller intended to pass a single url query string parameter. if the intention was to have several parameters, and one of them is a non-urlencoded URL then this won't work. also, if the caller now fixes the code that generates the query string, and starts to url-encode parameters, the fixes will not work either. a very fragile situation.