Question

It’s clear that for any reasonable-sized website, building it in modules using PHP includes has great advantages, so I chose to dynamically create the page content using includes. I was against the idea of including the header and footer, so I did the inverse like this (index.php):

    if(isset($_GET['page']))
    {
        $whitelist = array("contact","about","access", etc.);
        if(in_array($_GET['page'], $whitelist))
        {
           include($_GET['page'].".php");
        }

    }
    else
    {
        include('home.php');
    }

Some people object to this on security grounds (although they never give an alternative), but I find it to be a neat solution. My question is, what happens when my site has hundreds or even thousands of pages? Do I just keep adding variables to the whitelist array until it becomes huge, or is there a better way?

Answer 1

When your site has hundreds or thousands of pages, all unique, you’ll probably be storing them in database. And their URL slugs too (contact, about, etc.). So if get value is a valid slug (exists in table), here you go.