ansaurus

Question

index get var include

Answer 1

+1 A:

Just put all your pages in a folder (say "/pages"). Then before you do the include you check to see if the file exists in the pages folder.

Eric Petroelje 2010-01-06 20:54:36

The crucial part is the "check to see if the file is in the pages directory". Otherwise you will have a huge security code in your page.

Jan Hančič 2010-01-06 20:55:42

Answer 2

+1 A:

I'd definitely do the regex checking or even just flat-out santize (strip anything not alpha-numeric for example) then you can do a file_exists() check and if that succeeds, then include

James Maroney 2010-01-06 20:54:39

Answer 3

A:

Have a directory for pages, clean invalid characters out of the page path, and only include files from the pages directory. I think you have the right idea.

pygorex1 2010-01-06 20:55:51

Answer 4

A:

Like the others said, make sure you sanitize the variable. Here is one possible way, but theres like 20 ways you could do this:

function sanitizeAlpha($string)
{
    if (preg_match_all('/([A-Z]|[a-z]/', $string, $matches) > 0)
    {
        return implode($matches[0]);
    } else {
        die('Invalid Page Name');
    }
}

Mark 2010-01-06 20:58:22

Answer 5

+1 A:

If you don't want to use a whitelist, use basename on the $page variable to eliminate any parent dir exploit, then include the file in the pages/ directory. As long as you don't put files which should not be seen in that directory, you're fine.

kemp 2010-01-06 21:02:36

+1 - good point on avoiding ".." type exploits.

Eric Petroelje 2010-01-07 12:14:47

ansaurus

tags:

views:

answers:

index get var include

related questions