File Exists Safe?

Question

if (file_exists("pages/$page.php")) {
  include($page.'.php');
}

Is this safe?

With Safe i mean that you cant include remote scripts etc

Answer 1

The code you posted has a typo i believe. It should be:

if (file_exists("pages/$page.php")) {
  include("pages/$page.php");
}

It however leads to code injection, if PHP settings allow it, remote file inclusion.

You need to make sure the page that you include can not be any arbitrary page.

Usually you'll see this type of code in a "Loader" class employing the Factory Method, however, in good implementations it restricts the files and classes it will load to a certain directory, or to a certain predefined set of files.

Answer 2

Certainly not, especially if $page = "./configuration"

I would recommend replacing it with something like this:

$pages = array("blog", "home", "login");
if (in_array(strtolower($page), $pages))
  include("pages/$page.php");

EDIT: You can generate that list of acceptable pages with this code.

$pages = array();
if ($dh = opendir("pages")) {
  while (($file = readdir($dh)) !== false) {
    if (strstr($file, ".php") !== false) // make sure it is a .php file
      $pages[] = substr($file, -4); // remove the .php
  }
  closedir($dh);
}

Answer 3

If $page is never set, PHP will then try to find what it could be following the variables_order directive inside your php.ini. This directive tells PHP the order in which to find variables. Since the default for this is EGPCS, a cunning hacker then then call your script and tell it to include any file that PHP has access too.

Ex:

www.example.com/?page=dbConfig.ini

Answer 4

Storing all possible page names in an array is the safest approach, but you can also be reasonably safe by simply validating the supplied page name and ensuring that you don't have any "dangerous" files in your pages directory.

$page = basename($_GET['page']);
if (file_exists("pages/$page")) {
  include("pages/$page");
} else {
  include("pages/default.php");
}

Answer 5

Use basename($_REQUEST['page']) to prevent potential access to other directories then check if it exists.

http://php.mirror.facebook.net/manual/en/function.basename.php