note 23822 added to function.include

I've seen the following often enough to warrant mentioning it. Too many sites use URLs like the following for templating: /index.php?page=aboutme This URL is pretty ugly, but that's not the reason I'm writing this comment. In many cases, the code to implement this will be something like the following: include($_GET['page'].'.php'); Consider what happens then if someone accesses /index.php?page=index . Since included files run in the scope of the including file, the form variables are still valid and so index.php will include itself and will then proceed to do so infinitely until either the user stops the request or the PHP parser stops it because it's been running too long. Those of you putting your included files in subdirectories are not safe either. Include will happily accept relative paths, so accessing index.php?page=../index achieves the same thing in many cases. The solution, then, is to sanitize the variable before you use it. The easiest way is to use the regex replacement functions to only allow letters, numbers and underscores (which, conveniently, are all encapsulated by one regex special character) and this will ensure that none of the directory special characters are allowed. Of course, you will also need to check the special case of 'index' if your included files live in the same directory as index.php. -- http://www.php.net/manual/en/function.include.php http://master.php.net/manage/user-notes.php?action=edit+23822 http://master.php.net/manage/user-notes.php?action=delete+23822 http://master.php.net/manage/user-notes.php?action=reject+23822