simple include & security

[Conquester777]

www.domainnamehere.com/index.php?page=abcdef

include('$page');



dont have have any fool proof server side safe guards agaisnt the security risk??

[J. Meeter]

wtf are you talking about? are you talking about stuff like this: smartpunk.com/index.php?mainFrame=http://jordanmeeter.com ?

[squalleh]

cq777 said:

www.domainnamehere.com/index.php?page=abcdef

include('$page');



dont have have any fool proof server side safe guards agaisnt the security risk??

Turn of Register Globals, first of all. That'll eliminate a nice percentage of the security risk. With Register Globals enabled people could easily inject information that is unwanted into your forms.

Also, don't simply include whatever is in the HTTP POST. Check it for some validity. As it currently stands, somebody could include a malicious file, which could exploit and attack your host. So, you don't want that to be allowed.

Make an array containing every page you want recognized. Then check the HTTP POST against that array. If such a file is requested, and it happens to be in the array, allow it. At least, that's one such way of doing this. Another is to set up a Select Case statement, to include a certain file depending on the HTTP POST, and then a default file if nothing is matched. There are plenty of ways.

[Conquester777]

i think ill choose the array method, it's very easy.

why would any body use that select case stuff? it seems like a waste of time to me, a bit clunky. kinda like making a new function when you're only using the function in one place.

and what does turning off Register Globals do exactly?

[J. Meeter]

squalleh said:

cq777 said:

www.domainnamehere.com/index.php?page=abcdef

include('$page');



dont have have any fool proof server side safe guards agaisnt the security risk??

Turn of Register Globals, first of all. That'll eliminate a nice percentage of the security risk. With Register Globals enabled people could easily inject information that is unwanted into your forms.

Doesn't that depend on whether you're using GET or POST?

[Conquester777]

why does using GET, reduce security?