Search code examples
phpcodeignitersecuritycodeigniter-url

@ character allowed in URL, dangerous?

From the CodeIgniter config.php file:

/*
|--------------------------------------------------------------------------
| Allowed URL Characters
|--------------------------------------------------------------------------
|
| This lets you specify with a regular expression which characters are permitted
| within your URLs.  When someone tries to submit a URL with disallowed
| characters they will get a warning message.
|
| As a security measure you are STRONGLY encouraged to restrict URLs to
| as few characters as possible.  By default only these are allowed: a-z 0-9~%.:_-
|
| Leave blank to allow all characters -- but only if you are insane.
|
| DO NOT CHANGE THIS UNLESS YOU FULLY UNDERSTAND THE REPERCUSSIONS!!
|
*/
$config['permitted_uri_chars'] = 'a-z 0-9~%.:_\-';

Would it be safe for me to add the @ character to this list of permitted characters? What are the risks?

Thanks

Solution

  • its safe, see the list of unsafe chars

    http://www.blooberry.com/indexdot/html/topics/urlencoding.htm