You're better off having an array with the page names as keys, with their corresponding value as the location. Also in the interest of security, unless you need to use PHP within the "included" file, don't include the page. By including the page you're increasing the chance of having malicious PHP evaluated.
PHP Code:<?php
$page[''] = 'pages/home.htm';
$page['news'] = 'pages/news.htm';
$page['info'] = 'pages/info.htm';
if(file_exists($_tmp=$page[$_GET['page']]))
print file_get_contents($_tmp);
else
print "<strong>The page you requested could not be found.</strong>\r\n";
?>
That is a severe risk to your site's security, since anyone could obtain secret information hidden on your server or (if "allow_url_fopen" is enabled in php.ini) even include a malicious PHP page located on their own server. Furthermore, it was pointless splitting it into a function and using heredoc syntax.






Reply With Quote

