In redir.php:
header("Location: {$_GET['addr']}");
For fixing open redirect vulnerability i can think of several ways:
1- (Side effect of) Using a security token (anti-csrf token):
if(!isset($_SESSION['anticsrf_token'], $_GET['anticsrf_token']) or $_SESSION['anticsrf_token']!==$_GET['anticsrf_token']) exit('...');
This should work because an attacker cannot know and cannot create a valid anti-csrf token.
2- Comparing the domain of the 'redirect to address' with that of the script (redir.php) itself ($_SERVER['HTTP_HOST']).
3- The 'redirect to address' first can be stored by the referring script (the script that contains the link to redir.php) in the $_SESSION and then redir.php acts only on that session var:
header("Location: {$_SESSION['redir2addr']}");
A cookie can be used instead of session too.
I can think of some other ways too, but seems one of these is sufficient for my own app. I will appreciate any ideas and gotcha u know or can think of.