note 29282 added to function.include

As to the security risks of an include statement like: <?php include($page); ?> This is a really bad way on writing an include statement because the user could include server- or password-files which PHP can read as well. You could check the $page variable first but a simple check like <?php if ( file_exists($page) ) AND !preg_match("#^\.\./#",$page) ) include($page); ?> wont make it any safer. ( Think of $page = 'pages/../../../etc/passwd' ) To be sure only pages are called you want the user to call use something like this: <?php $path = 'pages/'; $extension = '.php'; if ( preg_match("#^[a-z0-9_]+$#i",$page) ){ $filename = $path.$page.$extension; include($filename); } ?> This will only make sure only files from the directory $path are called if they have the fileextension $extension. -- http://www.php.net/manual/en/function.include.php http://master.php.net/manage/user-notes.php?action=edit+29282 http://master.php.net/manage/user-notes.php?action=delete+29282 http://master.php.net/manage/user-notes.php?action=reject+29282