Base implementation

Is this safe? Seems like a big security (possible) hole for redirect injections