1

I see three issues with this: An attacker could set other query parameters than uid by e.g. using 123&foo=bar. Depending on how your site and how website.com works, this could lead to unexpected behaviour. To mitigate this, use some sort of whitelisting or filtering. E.g. if uid should always be a number, check that $_GET['uid'] only contains digits ...


1

If you want to tunnel any traffic you need to provide a tunnel entry at the network or IP layer and similar a tunnel endpoint too. A HTTP proxy is only an endpoint at the HTTP layer and can at most be used to tunnel TCP traffic with HTTP CONNECT request. And many HTTP proxies also restrict which ports or protocols such TCP traffic can use (i.e. HTTPS and ...


Only top voted, non community-wiki answers of a minimum length are eligible