Re: PHP include security

Hi Michiel! Thanks for the help, I really appreciate it. :) > It depends. What's exactly do you want to prevent? It doesn't seem like a > ...<snip>... > include, say, additional HTML content, use file_get_contents() instead. Very good points. My goal was to write a plugin that would allow me to include some static HTML template file and get the <?php include...?> tags out of my CMS template. With that said, I think the only people using this code will be the developers of the templates, and not your standard user. I opted to use output buffering and readfile() for the speed, and include() would be an option if developers want to execute the code in the included file. Would file_get_contents() be faster than readfile and output buffering? Would using file_get_conents() and eval() be faster than using include() and output buffering? Without boring you all to death, I am mostly interested in learning new stuff! I actually don't think anyone will use this code other than myself. :D But I definitely agree with all your points. Thanks so much for you help! Have a great day! Cheers, Micky