We’re rewarding the question askers & reputations are being recalculated! Read more.
1

I see three issues with this: An attacker could set other query parameters than uid by e.g. using 123&foo=bar. Depending on how your site and how website.com works, this could lead to unexpected behaviour. To mitigate this, use some sort of whitelisting or filtering. E.g. if uid should always be a number, check that $_GET['uid'] only contains digits ...


Only top voted, non community-wiki answers of a minimum length are eligible