On the website I'm building users can submit links to various of their personal page: YouTube accounts, Twitter, Facebook and a lot more. When he does so he furnishes the ID to his account. For example if the user freddiew wants to link his YouTube account, he just enter freddiew
in the field and a link to https://www.youtube.com/user/freddiew
will appear on his page.
I do it this way to prevent fishing. I'm wondering if there are things I need to worry about that I didn't think of? Better safe than sorry.
To clarify on the website I'm making an user can give his Steam id for example.
- He types his Steam ID:
louis
. - On his profile page a link will appear :
http://steamcommunity.com/id/Louis
.
My question is: is there a way for the user to redirect someone by adding some special string? In the same fashion you can add &direction=right
to add a parameter, is there a string that don't know about that can redirect the user like &redirect=true&url=myphishingsite.com
? I doubt it but I wanna be sure.
The reason I'm paranoid is because some of these sites I'm linking to are notorious for having people fall for phishing on them. I wanna save my users that hassle.
For example Facebook didn't sanitize an input that would redirect . It is fixed now but it did happen. So should I regex the input? If so, what char should I not allow?