note 66935 deleted from reserved.variables by bjori
| From: | bjori@php.net | Date: | Thu, 01 Jun 2006 12:59:32 +0000 |
| Subject: | note 66935 deleted from reserved.variables by bjori | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-112747@lists.php.net to get a copy of this message | ||
Note Submitter: pepieti at gmail dot com
Reason: bad code
----
If you absolutely want to use $_GET variable to include or open something you should use the
basename function to at least restrict access to specific folder.
Use something like this
<?php
if($_GET['page']){
$page = basename($_GET['page']);
include($page.".php");
}
else{
include("frontpage.php");
}
?>