includes and security

squeee

I'm using some simple includes to serve up pages based on a single URL variable. My code looks like this:

<?php
$page = $_GET['page'];
if (isset($page)) {
include("$page.php");
} else {
include("main.php");
}
?>

It works, but I'm worried that this is insecure as hell. What kinds of measures do I need to take to make this more secure (i.e. stripping code from $page etc.)? I'm running on Apache with PHP 4.32.

LordShryku

This leaves a really big hole in your code. If your filesystem allows it, anyone could potentially read anything on your system. I'd say for starters, limit the include to only allow files from within the document root. Maybe also check that the pages are of a specific filetype (ie. don't let them include .htaccess files). Honestly, I'd rather code a 500 line switch statement listing every allowed page instead of leaving it this open...

squeee

Thanks. But if permissions are set correctly, then anything that's requested in the URL string that's outside of the web site's root folder should return a permission denied error, right? Really I'm worried about someone trying to run a script or something else like that... What if I change it so that

<?php
$page = $_GET['page'];
if (isset($page)) {
include("$page.html");
} else {
include("main.html");
}
?>

Would this limit it to requests for .html files only? I'll admit that I'm pretty much a total newbie to PHP so I understand it's probably a lot more complicated than this, but I'm trying to get this done as quickly as I can with the least amount of programming possible... Right now I'm only looking at serving static files with the possibility of a MySQL DB connection in the future.

Edited to add:

OK, I realize now I need to add some way to keep people adding urls of documents on outside servers. What is the best way to do this? Check against an array or a database? Switch statement?

LordShryku

Yeah, that would limit it to html pages, though you may want to check the the file exists.

<?php
if(isset($_GET['page']) && file_exists($_GET['page'].'.html')) {
   include($_GET['page'].'.html');
}
else {
   include('main.html');
}
?>

squeee

Ah-ha. Thanks, you rock! I'm off to the bookstore now to start pillaging the O'Reilly section... 🙂