    def prevent_open_redirect(next, host):
        # Prevent an attacker from adding an arbitrary url after the
        # _next variable in the request.
        if next:
            parts = next.split('/')
            if ':' not in parts[0] and parts[:2] != ['', '']:
                return next
            elif len(parts) > 2 and parts[0].endswith(':') and parts[1:3] == ['', host]:
                return next
        return None
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.