Re: Serving docs from PHP

From:	Marek Kilimajer	Date:	Tue, 28 Oct 2003 13:25:05 +0000
Subject:	Re: Serving docs from PHP
References:	1	Groups:	php.general
Request:	Send a blank email to php-general+get-167867@lists.php.net to get a copy of this message

Alex James wrote:

<?php $c = $_GET["c"]; if ($c != "") {

			     include($c);

} else {

			     include("content1.php");
		      }

?>

The code is very unsafe, you include and execute any file, even remote if enabled in php.ini. You should use realpath() and substr() to check if the variable realy points to pkPatterns/ directory. Then check the file extension using pathinfo() and return apropriate Content-type header.