note 93347 deleted from function.include by googleguy

Note Submitter: rjw201 at cam dot ac dot uk ---- A even better security solution is to do the following: $path = basename($page, 'php') . '.php'; if(file_exists($path)) include $path; This will mean it will only load files with the ".php" extension in the current directory. Eg $page = 'myfile.php' => 'myfile.php' $page = '/etc/passwd' => 'passwd.php' => not found $page = 'myfile.jpg' => 'myfile.jpg.php' => not found Simple. Richard