I am programming a way in PHP for my users to be able to access a remote API though my website. I was wondering if any of you had some input on whether or not this was secure (NOT considering any vulnerabilities that may be on the remote system)

print file_get_contents("https://website.com/?uid={$_GET['uid']}");

Is this secure? if not, can you explain why?

Note: The site does not return any value that is sent using the uid parameter.

  • What is returned from the request? Is the content user generated? Nov 11, 2019 at 22:28
  • You used c/c++ before PHP, didn't you? Nov 12, 2019 at 2:16
  • @Conor .. maybe =) @ multithr3at3d - no, it's just basically a static text document that is returned.
    – xorist
    Nov 12, 2019 at 21:46
  • I went ahead and PHP-ified it, partly because it's shorter (and equally readable for people used to PHP), and partly to make it look a bit more like how it would "typically" be done in PHP. Nov 12, 2019 at 22:52

1 Answer 1


I see three issues with this:

  • An attacker could set other query parameters than uid by e.g. using 123&foo=bar. Depending on how your site and how website.com works, this could lead to unexpected behaviour. To mitigate this, use some sort of whitelisting or filtering. E.g. if uid should always be a number, check that $_GET['uid'] only contains digits first.

  • Whoever can control content on website.com can now control content on your site. This basically means that anyone who has access (legitimate or not) to website.com can XSS you or spread malware through your site. If you don't trust them fully, don't do this. Or make sure the Content-Type header is set to something where this is not an issue.

  • Open redirects! If website.com has an open redirect vulnerability, you have a big problem. An attacker can now make your site serve basically anything! You could tell PHP not to follow redirects to solve this, but if website.com relies on redirects for functionality this might cause you trouble.

  • Thank you for the answer, though I specify in the question that I'm looking particularly for only issues related to the method of calling out to the server and not issues related to the remote system it's self. (i.e., is there a way I could get out of the parameter declaration and open redirect via the method of accessing the remote system that's being used?) Though I didn't intend to specify such a specific question because I'm looking for answers even beyond just that.
    – xorist
    Nov 13, 2019 at 23:53
  • @xorist I have added some mitigations suggestions.
    – Anders
    Nov 14, 2019 at 14:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .