Posts: 255
Name: John Nerush
Location: Milton Keynes, UK
|
As said above, an array of safe words that can be used to call the include would be best. Otherwise you are laying the foundations of an insecure application (and I dont mean an app that hates the mirror!).
PHP Code:
<?php
@include("header.html"); @include("middle.html");
if ($_GET["action"]) { $includeFile = $_GET["action"] .".php"; if (@file_exists($includeFile)) @include($includeFile); else @include('error404.html'); } else { @include("content.html"); }
@include("footer.html");
?>
You could use the above to mimic a 404 responce but control the file included.
Alternativly you could place content.html in the include and have the user redirected to content.html in the event a file dosnt exist but this would be a bad practice without any message explaining why they are seeing a page they didnt expect.
Last edited by Phunk Rabbit; 05-18-2010 at 07:36 AM..
Reason: typo
|