It is recommended that any request parameter by which destination page is to be derived be a mapping value, rather than the actual URL or portion of the URL. This can prevent from:

Using mapping values instead of actual URLs prevents Unvalidated Redirects and Forwards. Instead of redirecting to user-supplied URLs, the application uses those values as keys to look up allowed destinations. This prevents attackers from crafting malicious redirect URLs to phishing sites. The mapping acts as a whitelist.