title: PHP Security - GET Variables, URL safe?
body: <p>I am creating a very basic iPhone simulator and what I want to do is just have it in one location, and then any site that we have and want to put it on, we would just call it using:  <a href="http://www.example.com/iphone-test.php?url=http://www.example.com/mobile/" rel="nofollow">http://www.example.com/iphone-test.php?url=http://www.example.com/mobile/</a></p>
  
  <p>Is there anything I need to look out for that could be un-safe?  There is no database involved or anything, but just in case someone wanted to mess around and put some stuff in the URL, what are some things I can do to help make this a little more safe?</p>
  
  <p>Here is my code:</p>
  
  <pre><code>&lt;?php
      if(isset($_GET['url'])) {
          $url = $_GET['url'];
          ?&gt;
  
          &lt;!doctype html&gt;
          &lt;html lang="en"&gt;
              &lt;head&gt;
                  &lt;meta charset="utf-8"&gt;
                  &lt;title&gt;iPhone Test&lt;/title&gt;
                  &lt;style type="text/css"&gt;
                  #iphone { 
                      background:url(iPhone.png) no-repeat; 
                      width:368px; height:706px; 
                      position:relative; 
                      overflow:hidden;  
                  }
                  #iphone iframe {
                      position:absolute; 
                      left:30px; 
                      top:143px; 
                      border:0;overflow:hidden; 
                  }
                  &lt;/style&gt;
              &lt;/head&gt;
              &lt;body&gt;
                  &lt;div id="iphone"&gt;
                  &lt;iframe src="&lt;?=$url;?&gt;" width="307" height="443"&gt;&lt;p&gt;Your Browser does not support iFrames.&lt;/p&gt;&lt;/iframe&gt;
                  &lt;/div&gt;
              &lt;/body&gt;
          &lt;/html&gt;
          &lt;?php
      }
  ?&gt;
  </code></pre>
  
  <p><strong>Edit:</strong> Thanks for all of your help.  I did some research and here is what I have so far:</p>
  
  <pre><code>&lt;?php
  include_once 'filter.php';
  $filter = new InputFilter();   
  
  if(isset($_GET['url'])) {
  if (filter_var($_GET['url'], FILTER_VALIDATE_URL)) {
      $url = $filter-&gt;process($_GET['url']);
  ?&gt;
  </code></pre>
  
  <p>Source: <a href="http://oozman.com/php-tutorials/avoid-cross-site-scripting-attacks-in-php/" rel="nofollow">http://oozman.com/php-tutorials/avoid-cross-site-scripting-attacks-in-php/</a></p>
  
  <p>Class: <a href="http://www.phpclasses.org/browse/file/8941.html" rel="nofollow">http://www.phpclasses.org/browse/file/8941.html</a></p>
  
  <p>What do you think?</p>