note 36803 deleted from function.include by sniper
| From: | sniper@php.net | Date: | Tue, 04 Nov 2003 00:43:26 +0000 |
| Subject: | note 36803 deleted from function.include by sniper | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-59803@lists.php.net to get a copy of this message | ||
Note Submitter: dbnm@hotmail.com
----
here are two good ways to us the include as a lay-out.
1) this one show the page file type ex. id=page.php
<?php
if (empty($_GET['id'])) $_GET['id'] = "starting page";
if (strstr ($_GET['id'], "http://") || strstr
($_GET['id'], "../") || strstr ($_GET['id'], "ftp://")) {
echo "Malicious Code Detected";
} elseif (!file_exists("./".$_GET['id'])) {
echo "File not found";
} elseif (!@include("./".$_GET['id'])) {
echo "File could not be included";
}
?>
2) this one doesn't show that file type ex. id=page
<?php
if($_GET['id']){
if(file_exists("$DOCUMENT_ROOT/$id.html")){
include_once("$id.html");
} elseif(file_exists("$DOCUMENT_ROOT/$id.php")){
include_once("$id.php");
} elseif(file_exists("$DOCUMENT_ROOT/$id")){
include_once("$id");
}
}else {
echo "File could not be included";
}
?>