note 79848 added to function.include

If for some reason you want to use URL instead of relative path for including local files with $_GET variable, and you want to validate that URL points to your site to prevent cross site scripting, you can use this function. <? if (validate_domain($url_from_GET)) { include($url_from_GET); } function validate_domain($url) { preg_match('@^(?:http://)?([^/:]+)@i',$url,$matches); $host=$matches[1]; preg_match('/[^.]+\.[^.]+$/',$host,$matches); if($matches[0]==$_SERVER['HTTP_HOST']) return true; else return false; } ?> Note that domains with double extension like somesite.co.uk need additional [^.]+ in second preg_match. Lazar -- http://www.inverudio.com ---- Server IP: 209.41.74.194 Probable Submitter: 24.136.17.152 ---- Manual Page -- http://www.php.net/manual/en/function.include.php Edit -- https://master.php.net/note/edit/79848 Del: integrated -- https://master.php.net/note/delete/79848/integrated Del: useless -- https://master.php.net/note/delete/79848/useless Del: bad code -- https://master.php.net/note/delete/79848/bad+code Del: spam -- https://master.php.net/note/delete/79848/spam Del: non-english -- https://master.php.net/note/delete/79848/non-english Del: in docs -- https://master.php.net/note/delete/79848/in+docs Del: other reasons-- https://master.php.net/note/delete/79848 Reject -- https://master.php.net/note/reject/79848 Search -- https://master.php.net/manage/user-notes.php