How can I parse_url in PHP when there is a URL in a string variable?

Question

I am admittedly a PHP newbie, so I need some help.

I am creating a self-designed affiliate program for my site and have the option for an affiliate to add a SubID to their link for tracking. Without having control over what is entered, I have been testing different scenarios and found a bug when a full URL is entered (i.e. "http://example.com").

In my PHP I can grab the variable from the string no problem. My problem comes from when I get the referring URL and parse it (since I need to parse the referring URL to get the host mane for other uses). Code below:

$refURL = getenv("HTTP_REFERER");

$parseRefURL = parse_url($refURL);

WORKS when incoming link is (for example):

http://example.com/?ref=REFERRER'S-ID&sid=www.test.com

ERROR when incoming link is (notice the addition of "http://" after "sid="):

http://example.com/?ref=REFERRER'S-ID&sid=http://www.test.com

Here is the warning message:

Warning: parse_url(/?ref=REFERRER'S-ID&sid=http://www.test.com) [function.parse-url]: Unable to parse url in /home4/'directory'/public_html/hosterdoodle/header.php on line 28

Any ideas on how to keep the parse-url function from being thrown off when someone may decide to place a URL in a variable? (I actually tested this problem down to the point that it will throw the error with as little as ":/" in the variable)

Answer 1

Why not sanitize the $refURL by using str_replace to strip out the http://?

Answer 2

The following portion of code :

$url = "http://example.com/?ref=REFERRER'S-ID&sid=http://www.test.com";
$data = parse_url($url);
var_dump($data);

is working fine for me (PHP 5.3.2), and gives the following output :

array
  'scheme' => string 'http' (length=4)
  'host' => string 'example.com' (length=11)
  'path' => string '/' (length=1)
  'query' => string 'ref=REFERRER'S-ID&sid=http://www.test.com' (length=41)

Are you sure that you're passing a full URL to parse_url ?

If I use this portion of code :

$url = "/?ref=REFERRER'S-ID&sid=http://www.test.com";
$data = parse_url($url);

I get the same warning as you :

Warning: parse_url(/?ref=REFERRER'S-ID&sid=http://www.test.com) 
[function.parse-url]: Unable to parse URL

But this is when not passing a full URL...