Should I be using a relative or absolute path for best security or best practice in PHP header()

Question

I have this code that my question is on.

if ($_FILES["file"]["error"] > 0){
    $_SESSION['NOFILE'] = true;
    header( 'Location: http://www.website.com/files/.index.php');
}


//Should I be using the absolute path like I have here. or should I use 

if ($_FILES["file"]["error"] > 0){
    $_SESSION['NOFILE'] = true;
    header( 'Location: /files/.index.php');
}

I have this question because Im newer to PHP. I would like to thank you all in advanced - kim :) P.S. new to SOF to so i couldnt format my code.

It is not a matter of security. It is a matter of spec. The spec clearly states you should use an absolute url. BTW you should also always `exit;` after a redirect to prevent further execution of the script. — PeeHaa, Jun 15 '13 at 21:10
@PeeHaa埽 When i call exit will that prevent it from again at all or just that one time the script was called? — smith...amy, Jun 15 '13 at 21:18

score 2 · Accepted Answer · answered Jun 15 '13 at 21:13

The HTTP spec requires a full URL, so you should always use that.

Some implementations (ie browsers) will accept a path without the domain, and assume it refers to the current domain, but you should not count on it.

It's easy enough to construct the full path using the available $_SERVER variables, so you should make sure you always do it.

Should I be using a relative or absolute path for best security or best practice in PHP header()

1 Answers1