Don't trust external data.
isset() performs no validation, I would never dump the contents of a GET var stright into a process without validating it first. A switch does; if the incoming data doesn't comform to one of the cases, a default value can be used.
A switch or an array will do the job nicely. For eg.
Typically I use 3 steps to load includes based on a GET var. Step 1, validate the get var, step 2, check that the include exists, step 3, include the corresponding file.
script: includes/inc_functions.php
PHP Code:
//dual purpose: return bool (true/false) GET var is an index of includes array
// return string of path/filename to include
function includePage($pageName, $validKey = true) {
//add items to include array as required
//associative index = string preceding extension full-stop
//value = relative path to include from root
$arr_includes['page1'] = 'includes/inc_page1.php';
$arr_includes['page2'] = 'includes/inc_page2.php';
if($validKey) {
$returnBool = array_key_exists($pageName, $arr_includes);
return $returnBool;
} else {
//grab include path from array and test if it exists
$include_path = (@file_exists($arr_includes[$pageName])) ? $arr_includes[$pageName] : false;
return $include_path;
}
}
html: includes/inc_page1.php
Code:
<p>The qwik brown fox jumped over the lazy page one.</p>
html: includes/inc_page2.php
Code:
<p>The qwik brown fox jumped over the lazy page two.</p>
html: includes/inc_page_error.php
Code:
<p style="color: #FF0000">Error: Page does not exist or has been archived.</p>
Tying all files together to toggle the include.
script: content.php
PHP Code:
<?php
include_once('includes/inc_functions.php');
$thisPage = (!empty($_GET['page'])) ? $_GET['page'] : false;
$validPage = false;
//default page to load if GET var is invalid
$includePage = 'includes/inc_page_error.php';
//validate GET var for page
if($thisPage) {
$validPage = includePage($thisPage, true);
}
//if valid page, overwrite default includePage
if($validPage) {
$includePage = includePage($thisPage, false);
}
?>
<html><head>
<title>Test Includes</title>
</head>
<body>
<div id="content">
<?php include_once($includePage); ?>
</div>
</body></html>
function includePage() performs get var validation, file_exists() validation and if everything validates returns the appropriate include.