How to validate user input - php

Question

I'm using a script, written in PHP and Jquery, that allows to scrape a static website:
<?php
if(isset($_GET['site'])){
$f = fopen($_GET['site'], 'r');
$html = '';
while (!feof($f)) {
$html .= fread($f, 24000);
}
fclose($f);
echo $html;
}
?>
The Jquery part:
$(function(){
var site = $(input).val();
$.get('proxy.php', { site:site }, function(data){
$('#myDiv').append(data);
}, 'html');
});
As you can see the website that needs to be scraped has to be value in input. I want to give my visitors the ability to set there own website to be scraped.
The problem is that I cant figure out how to secure the PHP part. As I understand the input value is a big security risk because anything can be sent with value. I already experienced slow performance and several 'pc crashes' working with this code. Im not sure if the crashes are related but they only happen when I work on the code.
Anyway I would really like to know how to validate the value(from input) sent to my server, only REAL urls should be aloud. I googled for days but I cant figure it out (new at PHP)
ps If you spot any other security risks please let me know..

Answer 1

I think your main security issue, is that you're using fopen to read the content of the url, if the user wants to read a file in your system, then he has to send the path to that file and if the script has enough permissions, then they'll be able to access the content of your hard drive.
I would recommend using other methods like Curl or at least, validating the user input to make sure that it's a valid url, for this, I would check out some regular expressions
Good luck with your code!
Edit on validation
Here is a little example of what I meant by validation.
<?php
if(isset($_GET['site'])){
if(validURL($_GET['site']) {
$f = fopen($_GET['site'], 'r');
$html = '';
while (!feof($f)) {
$html .= fread($f, 24000);
}
fclose($f);
echo $html;
} else {
echo "Invalid URL, please enter a valid web url (i.e: http://www.google.com)";
}
}
function validURL($url){
//here goes your validation code, returns true if the url is valid
}
?>
But if you're too new to understand this, I would suggest going for simpler examples, since this is pretty basic logic.

Answer 2

Its so sad that you could not find anything on the internet about this topic. Its a common thing. Please refer the links below. It may be of help.
PHP validate input alphanumeric plus a few symbols
http://phpmaster.com/input-validation-using-filter-functions/