动态包含

Question

What would be the safest way to include pages with $_GET without puttingt allowed pages in an array/use switch etc. I have many pages so no thank you.

$content = addslashes($_GET['content']);

if (file_exists(PAGE_PATH."$content.html")) { 
include(PAGE_PATH."$content.html");
}

How safe is that?

Thanks.

Answer 1

You should use at least something like that to prevent XSS attacks.

$content = htmlentities($_GET['page'], ENT_QUOTES, 'UTF-8');

And addslashes won't protect you from SQL Injections.