im making a small site
And Instead of having a header.php and a footer.php with neccesarry info (functions,dbconnection, html head) and include on every page I’d like to have it all in index.php. But then I have to add pages to an whitelist and all this. I’d just like to be able to drop it in pages/ and then access it with index.php?page=test
How would I include pages without having to make a big whitelist? How about using preg_match and checcking that page variable only contain a-z. no evil dots. if it only contain letter a-z > include?
or maybe use glob and scan pages/, add them to array so i dont have to edit index.php every time
please tell me your thoughts and ideas
<html>
<head>
<title>SindACC</title>
</head>
<body>
<?php include($page) ?>
</body>
</html>
If you don’t want to use a whitelist, use
basenameon the$pagevariable to eliminate any parent dir exploit, then include the file in thepages/directory. As long as you don’t put files which should not be seen in that directory, you’re fine.