Question

I desperately want to use server-side includes in a project I’m working on because I just have some HTML that repeats and I need to get it on several pages. Must I use ascx or some other include technology… I mean, will lightning strike if I use server-side includes?

My client — the middle-person — says “do what’s easiest, this will probably be redone in a CMS soon anyway.” Can I not use server-side includes?

It’s ASP.NET 2.0.

Note: I feel this has been asked before, but I couldn’t find it. If it has, please let me know and I will personally delete it, thanks!

Edit: Any way to get an include ON ONE LINE would be fine with me, if you have suggestions.

Edit: Why do I like includes?

Include code:

!--#include file="inc_footer.aspx"-->

the same code for a control. First you need one of these

<%@ Register TagPrefix="a" TagName="HeyFooter" Src="inc_footer.ascx" %>

and then you can use it like this

<a:HeyFooter runat="server" />

this is kind of long for what I need.

Note Two security concerns with includes: 1) don’t use the .inc extension, since it can be browsed. 2) do not include filenames based on user variables, as the best answer points o ut.

Answer 1

If you include a file via a string variable: <!--#include file=some_variable -->, then depending on how that variable is filled there are possible attacks a hacker could do to include his own files and run arbitrary code on your machine. But as long as you use a string literal, you won’t run into this problem.

I would use Master Pages in ASP.NET. This is the accepted way to have common areas of a page.

You would create a Master Page similarly as you would regular pages, then modification of each of the other pages would be minimal. Add a single line to the top of each page file, then specify the sections used.