The attacker does not need to trick users into visiting evil.com. They trick them into visiting yoursite.com which redirects them there automatically. This is the seventeenth article in a series on PHP and Laravel application security. So far we have covered: Detecting SQL injection attempts in PHP logs Why URL encoding blinds most PHP security checks The decode bomb problem with unlimited URL decoding Why parameterized queries are the only real fix for SQL injection XSS preve...