Php Include security - Using an Array and name prefix

Question

I'm learning php on my own now and I'm developing some simple sites using php include to ease the page creation process. I've searched this website for ways to make it secure but, as a noob, I'm always afraid of messing up.

<?php
    $siteArticles = array('instalacoes','galeria','regiao-e-historia','precos','contactos');
    if( isset($_GET['page']) ){
        if( in_array($_GET['page'], $siteArticles, true) && file_exists('pt/'.'rbs-article-'.$_GET['page'].'.php') ){ 
            include('pt/'.'rbs-article-'.$_GET['page'].'.php'); 
        }
    }else{
        include('pt/rbs-article-home.php');
    }
?>

As you can see, it first checks if the page's allowed through the array and then add a prefix to the name file.

My question is, how secure is this?

Thank you for your time.

MrCode · Accepted Answer · 2013-02-15 11:43:02Z

3

It is secure. The in_array() check is what makes it secure. It is not possible to perform a Local File Inclusion (LFI) attack on this code simply because the requested page must exactly match one of the elements in the whitelist array.

answered Feb 15, 2013 at 11:43

MrCode

64.6k10 gold badges95 silver badges114 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

MarcDefiant Over a year ago

Just because I'm paranoid, I'd still use array_search and get the page name using the index instead of using $_GET['page']

Collectives™ on Stack Overflow

Php Include security - Using an Array and name prefix

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related