title: PHP: Security when using CURL?
body: <p>I have a page like this. User write an URL into a form and submit. Once the URL is submitted, I connect that page with CURL, search for a string. If it finds the string, it adds URL into our database. If not, it gives an error to user.</p>
  
  <p>I sanitize URL with htmlspecialchars() also a regex to allow A-Z, 1-9, :/-. symbols. I also sanitize the content retrieved from other website with htmlspecialchars() also.</p>
  
  <p>My question is, can they enter an URL like; 
  www.evilwebsite.com/shell.exe or shell.txt</p>
  
  <p>Would PHP run it, or simply look for the HTML output? Is it safe as it is or if not, what should I do?</p>
  
  <p>Thank you.</p>
  
  <p>Ps. allow_url_fopen is disabled. That's why I use curl.</p>