note 29282 deleted from function.include by peehaa
| From: | peehaa@php.net | Date: | Fri, 09 Dec 2016 22:57:15 +0000 |
| Subject: | note 29282 deleted from function.include by peehaa | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-208403@lists.php.net to get a copy of this message | ||
Note Submitter: redeye at cs-aktuell dot de
----
As to the security risks of an include statement like:
<?php
include($page);
?>
This is a really bad way on writing an include statement because the user could include server- or
password-files which PHP can read as well. You could check the $page variable first but a simple
check like
<?php
if ( file_exists($page) ) AND !preg_match("#^\.\./#",$page) )
include($page);
?>
wont make it any safer. ( Think of $page = 'pages/../../../etc/passwd' )
To be sure only pages are called you want the user to call use something like this:
<?php
$path = 'pages/';
$extension = '.php';
if ( preg_match("#^[a-z0-9_]+$#i",$page) ){
$filename = $path.$page.$extension;
include($filename);
}
?>
This will only make sure only files from the directory $path are called if they have the
fileextension $extension.