Search code examples
phpsecurityurlrobustness

Converting a filepath to a url securely and reliably

I'm using php and I have the following code to convert an absolute path to a url.

function make_url($path, $secure = false){
    return (!$secure ? 'http://' : 'https://').str_replace($_SERVER['DOCUMENT_ROOT'], $_SERVER['HTTP_HOST'], $path);
}

My question is basically, is there a better way to do this in terms of security / reliability that is portable between locations and servers?

Solution

  • The HTTP_HOST variable is not a reliable or secure value as it is also being sent by the client. So be sure to validate its value before using it.