PHP在获取编辑ID时包含链接不起作用

Question

first time posting here, but need help as I am quite new to PHP, and I've searched but couldn't find a similar question.

My index file has this php include:

include($_GET['underside']);

On one of my other pages (opret.php) I've created a CRUD and everything works. However when I try to fetch the data from a given ID, in to my inputs, the link won't work with the include.

The link is as following:

<a href="opret.php?rediger=<?php echo $row['TilbudId']; ?>" class="btn btn-info">Rediger</a>

Which ends up being this in the browser:

http://localhost:8080/StampIT/index.php?underside=opret.php?rediger=7

I know this seems a bit far out, but I don't know if theres a way around it. I am getting these errors:

Warning: include(opret.php?rediger=7): failed to open stream: No such file or directory in D:\wamp64\www\StampIT\index.php on line 56

And

Warning: include(): Failed opening 'opret.php?rediger=7' for inclusion (include_path='.;C:\php\pear') in D:\wamp64\www\StampIT\index.php on line 56

I can make it work if I just forget about includes and make separate pages for everything, however I would really like to avoid that.

I hope someone can help, and that it was somewhat understandable. Thanks!

Answer 1

http://localhost:8080/StampIT/index.php?underside=opret.php?rediger=7

You have to seperate GET parameters with a & sign. It has to be

http://localhost:8080/StampIT/index.php?underside=opret.php&rediger=7

Besides: The include looks like a potential file inclusion vulnerability. An attacker could manipulate that parameter and include a file (or probably even remote script) that is not supposed to be processed by your site. For example index.php?underside=/etc/passwd