TalkPHP - View Single Post - PHP Injection

drewbee · 07-02-2008, 07:34 PM

and If you must dynamically include files, dont use variables to do it. Use some type of switch, of which you hard code the file names.

IE

PHP Code:


			
$file = '';
switch ($_GET['page'])
{
    case 'login':
    $file = 'login.php';
    break;
 
    case 'register':
    $file = 'register.php';
    break;
 
    case 'contact':
    $file = 'contact.php';
    break;
 
    default:
    $file = 'index.php';
}
 
if (file_exists($file))
{
    include($file);
}

07-02-2008, 07:34 PM	#5 (permalink)
drewbee The Acquainted Join Date: May 2008 Posts: 175 Thanks: 9	and If you must dynamically include files, dont use variables to do it. Use some type of switch, of which you hard code the file names. IE PHP Code: `$file = ''; switch ($_GET['page']) { case 'login': $file = 'login.php'; break; case 'register': $file = 'register.php'; break; case 'contact': $file = 'contact.php'; break; default: $file = 'index.php'; } if (file_exists($file)) { include($file); }` __________________ There are No Stupid Questions. But there a LOT of Inquisitive Idiots.