Question

When I use the following PHP code:

$id = $_GET['page']; $page = include ($id.'.php'); echo $page;

The code within the $id.php file is returned, however there is a “1” appended to it, any idea why this is happening?

Answer 1

include() will return boolean TRUE if the file was successfully included. You then echo out that true value, which is printed as a 1.

Of note: never directly use user-provided data ($_GET[‘page’]) in file system operations. It’s a hideious security risk. You’ve at least got .php being appended so it’s not quite as large a gaping hole, but still… don’t do this.