Prevent user access tot file system

[Anon]

Hi there!

I've got a simple script to build up a page, somewhat like:

content.php
<?php
include 'header.inc';
include '$page';
include 'footer.inc';
?>

Once a user acces http://www.domain.com/content.php?page=XXXX

They can have access to /../../../etc/passwd

How do I prevent this?

GreetZ,
Marco

[mikikg]

For security reasons it is nessery to define all pages you will use. Instead using content.php?page=index.php you may use content.php?page=1. Here is a code with SWITCH / CASE statements.

switch ($page)
{
case "1": //home
include ("home.php");
break;

case "2": //about us
include ("aboutus.php");
break;

...
...
...
etc.

default: //all other cases
echo "not allowed!";
}