This has been covered MANY, MANY times on the boards here, so do a search of this topic.
The general idea that seems to widely accepted is to put the ACCEPTABLE requests into an array.
Then, when you receive a request for a certain file, IF it is acceptable, meaning that it is in the array of files you can serve to the users, then include it.
If it is a BAD request, either by mistake or done maliciously, you may serve your default page OR an error message, whichever you prefer.
Somthing like this:
<?php
// array of acceptable file request
$files = array('about','contact','order','products');
// default file to include if request is invalid or not set
$default = 'default.php';
if(!isset($_GET['page']) || !in_array($files, $_GET['page']))
{
include_once($default);
}
elseif(!file_exists($_GET['page'] . '.php'))
{
include_once($default);
}
else
{
include_once($_GET['page'] . '.php');
}
?>
Just keep in mind that you have to update the array everytime you add a new page, so it is probably best to put it this into a function and include your verification process into everypage, so each page has the same array, and that it is easy to maintain or change when needed...
