note 79848 deleted from function.include by nlopess

Note Submitter: lazar at inverudio dot com ---- If for some reason you want to use URL instead of relative path for including local files with $_GET variable, and you want to validate that URL points to your site to prevent cross site scripting, you can use this function. <? if (validate_domain($url_from_GET)) { include($url_from_GET); } function validate_domain($url) { preg_match('@^(?:http://)?([^/:]+)@i',$url,$matches); $host=$matches[1]; preg_match('/[^.]+\.[^.]+$/',$host,$matches); if($matches[0]==$_SERVER['HTTP_HOST']) return true; else return false; } ?> Note that domains with double extension like somesite.co.uk need additional [^.]+ in second preg_match. Lazar -- http://www.inverudio.com