note 84080 deleted from language.oop5.patterns by danbrown
| From: | danbrown@php.net | Date: | Sun, 23 Jan 2011 16:37:40 +0000 |
| Subject: | note 84080 deleted from language.oop5.patterns by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-176101@lists.php.net to get a copy of this message | ||
Note Submitter: tedmasterweb at gmail dot com
----
Regarding Example #1:
Be sure to "sanitize" your variables before using them for including files.
Example #1 assumes the variable $type contains sanitized data (and NOT something threatening like
'../../../../../etc/passwd').
One approach might be as follows:
<?php
switch ( $type ) {
case "MySQL":
$type = 'mysql';
break;
case "SQLite":
$type = 'sqlite';
break;
default:
throw new Exception ('Driver not found');
}
if (include_once 'Drivers/' . $type . '.php') {
$classname = 'Driver_' . $type;
return new $classname;
} else {
throw new Exception ('Driver not found');
}
?>
Naturally, the examples are brief and intended to express the issue at hand, not input sanitizing
methods, but someone might find this note helpful.
HTH