Include safety

Question

<?php
if (preg_match('/^[a-z0-9]+$/', $_GET['page'])) {
$page = realpath('includes/'.$_GET['page'].'.php');
$tpl = realpath('templates/'.$_GET['page'].'.html');
if ($page && $tpl) {
    include $page;
    include $tpl;
} else {
    // log error!
}
} else {
// log error!
}
?>

How safe would you say this is? Gumbo here on Stack Overflow wrote it.
http://stackoverflow.com/questions/524908/dynamic-include-safety/524959#524959

I wanna hear your opinions.

cheers

Answer 1

you including your own code. how safe is it?

Answer 2

My first thought isn't about safety, but about why in the world would you do that?

Answer 3

I'd say it's pretty safe. Just don't allow anything to write to those folders. PHP files are traditionally inside the web root of a server which is dangerous to start with. It would be better to place the files being loaded to an area that's absolutely inaccessible to the outside given a configuration error or a .htaccess file going missing.

Answer 4

I could see some potential issues there, especially if the 'page' variable contained '..' or other such things that could allow them to see something they weren't supposed to be able to see.

I do something similar on a few sites of mine, but I would first check 'page' to make sure it references one of a set of allowed pages.