redirect.php

<?php
require_once 'config/database.php';

$code = $_GET['code'] ?? '';

if (empty($code)) {
    http_response_code(404);
    echo "404 Not Found";
    exit;
}

$database = new Database();
$db = $database->getConnection();

$stmt = $db->prepare("SELECT id, original_url FROM short_links WHERE short_code = ?");
$stmt->execute([$code]);
$link = $stmt->fetch(PDO::FETCH_ASSOC);

if ($link) {
    $url = $link['original_url'];

    // Validate URL to prevent open redirect
    $parsed = parse_url($url);
    if ($parsed === false || empty($parsed['host'])) {
        $url = '/';
    }

    // Whitelist allowed schemes
    $scheme = $parsed['scheme'] ?? '';
    if (!in_array($scheme, ['http', 'https', ''])) {
        $url = '/';
    }

    // Increment click count
    $update = $db->prepare("UPDATE short_links SET click_count = click_count + 1 WHERE id = ?");
    $update->execute([$link['id']]);

    header("Location: " . $url);
    exit;
} else {
    http_response_code(404);
    echo "404 Not Found - Link does not exist";
    exit;
}
?>