what a problem- help!

[Anon]

Hi all, I'm hoping someone may provide the answer to a problem which is REALLY doing my head in. I'm a php beginner, so I need stuff in simple terms if poss.

Basically I have a .php page which is set to 'include' a file. But, I want that file (the one to be included) to be determined in the URL, e.g...

www.mysite.com/page.php?include=product1

...would 'include' a text file named product1.

I don't know how this can be done, or whether it uses the 'include' function at all, so if anyone could tell me how it could be achieved, or point my towards some links that would assist me, I'd be most grateful.

Regards, Andy, Nottm. U.K.

[lawnmowerman]

Sure! This is quite easy!

include( $include );

You don't have to use constant strings as the parameters to functions. You can use a variable which contains the string.

Hope this helps!

-Rich

[Anon]

be sure to check if the variable include is set...

if(isset($include))
{
include($include)
}
etc.

cheers
nilesh.

[kparker]

This is an immense security risk. Imagine someone setting up the following URL and submitting it:

www.mysite.com/page.php?include=/etc/passwd

Ouch!

One way to tighten this down is to have an array of valid include-files and check against it first:

$allow = array('file1.php' => 1, 'file2.php' => 1 );

   if ( $allow[ $include ] > 0 )
      include( $include );
   else
      die("Go away, hacker!");

Another method is to prohibit any slashes in the variable; this prevents
getting at directories above the web root:

   if ( ereg('/', $include ))
      die("Go away, hacker!");
   else
      include( $include );

[Anon]

thanks guys- all the tips I've combined and look to be solving the problem now.

Thanks again,

Andy, UK.

[lawnmowerman]

Well, in my opinion, a properly configured php.ini will restrict the include_path to safe directories. 🙂

-Rich