Open redirect
Why it matters
Attackers send links on your trusted domain that bounce visitors straight to phishing pages.
header('Location: ' . $_GET['next']);$next = $_GET['next'] ?? '/';
if (!str_starts_with($next, '/') || str_starts_with($next, '//')) {
$next = '/';
}
header('Location: ' . $next);How to fix
Only redirect to paths on your own site or to a whitelist of known URLs.
Scan my code
Scan my code β
Paste a file and PHP Safe points to every line that matches this rule.