Is it secure to use a controller, module or action name to set include paths?

Question

I want to set up include paths (and other paths, like view script paths) based on the module being accessed. Is this safe? If not, how could I safely set up include paths dynamically? I'm doing something like the code below (this is from a controller plugin.)

public function dispatchLoopStartup(Zend_Controller_Request_Abstract $request) {

    $modName = $request->getModuleName();
    $modulePath = APP_PATH.'/modules/'.$modName.'/classes';
    set_include_path(get_include_path().PATH_SEPARATOR.$modulePath);

}

Answer 1

I'm not sure whether it is safe or not, but it doesn't sound like the best practice. What if someone entered a module name like ../admin/? You should sanitize the module name before using it.

Answer 2

It's fine as long as you sanitize your variables before using them, but it won't be very performant. Fiddling with include paths at runtime causes a serious impact performance.

You're trying to load models/helpers per module? You should look at Zend_Application:

Zend_Application provides a bootstrapping facility for applications which provides reusable resources, common- and module-based bootstrap classes and dependency checking. It also takes care of setting up the PHP environment and introduces autoloading by default.

Emphasis by me