blocks|key|1667732|text|做你的方法没什么错。只需添加一些基本验证，就可以知道恶意用户不会尝试访问其他路径。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1667733|我建议确认字符串中没有斜杠和点(因为Windows中的路径是./或/或\)。甚至可能会在结束时硬编码一个.PHP，以防止访问其他文件类型。|1667734|if+(strstr($_GET['page'],+".")+%7C%7C+strstr($_GET['page'],+"/")+%7C%7C+strstr($_GET['page'],+"\\")
{
++++echo+"error";
++++exit;
}

include($_GET['page']+.".php");|code-block|syntax|javascript|1667735|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|L|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|M|8|@]|9|@]|A|$G|H]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

There's nothing wrong with doing your method. Just add some basic validation, so you know that a malicious user isn't going to try to access other paths.

I would recommend validating that slashes and dots aren't in the string (because of paths like ../ or / or \ in Windows). And maybe even hard-code a .PHP at the end to prevent other file types from being accessed.

<pre><code>if (strstr($_GET['page'], ".") || strstr($_GET['page'], "/") || strstr($_GET['page'], "\\")
{
 echo "error";
 exit;
}

include($_GET['page'] .".php");
</code></pre>

blocks|key|347962|text|根据我的评论，我会做这样的事情。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|347963|switch($_GET['page'])+{
++++case+'index'+:
++++++++redirect_tempo(500,+'index.php?page=home');
++++break;
++++........
++++default+:
++++++++die('NO!');
++++break;
}|code-block|syntax|javascript|347964|然而，这并不是最好的方法。|347965|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

Going with my comment, I would do something like this. 

<pre><code>switch($_GET['page']) {
 case 'index' :
 redirect_tempo(500, 'index.php?page=home');
 break;
 ........
 default :
 die('NO!');
 break;
}
</code></pre>

However this is not the best way of going about this.

blocks|key|348002|text|这部分是危险的：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|348003|elseif+(file_exists($_GET['page'].".php"))|code-block|syntax|javascript|348004|我可以给路径"../../../../etc/passwd"+(我知道，这有点旧，但它可以是任何东西)，它会读取文件(赋予足够的权限)。|offset|length|style|CODE|348005|一个简单的解决办法可以是：|348006|elseif+(file_exists(basename($_GET['page'])+.+".php"))|348007|不要忘记对实际的require也应用相同的东西|348008|require+basename($_GET['page'])+.+'.php';|348009|您还可以将basename()应用到更高的位置，这样您就不必再应用该函数两次了|348010|另见：basename|348011|entityMap|0|LINK|mutability|MUTABLE|url|http://www.php.net/basename^0|0|0|6|O|0|0|0|8|7|0|0|5|A|0|3|8|3|8|0|0^^$0|@$1|2|3|4|5|6|7|16|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|17|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|18|8|@$I|19|J|1A|K|L]]|9|@]|A|$]]|$1|M|3|N|5|6|7|1B|8|@]|9|@]|A|$]]|$1|O|3|P|5|D|7|1C|8|@]|9|@]|A|$E|F]]|$1|Q|3|R|5|6|7|1D|8|@$I|1E|J|1F|K|L]]|9|@]|A|$]]|$1|S|3|T|5|D|7|1G|8|@]|9|@]|A|$E|F]]|$1|U|3|V|5|6|7|1H|8|@$I|1I|J|1J|K|L]]|9|@]|A|$]]|$1|W|3|X|5|6|7|1K|8|@$I|1L|J|1M|K|L]]|9|@$I|1N|J|1O|1|1P]]|A|$]]|$1|Y|3|-4|5|6|7|1Q|8|@]|9|@]|A|$]]]|Z|$10|$5|11|12|13|A|$14|15]]]]

This part is dangerous:

<pre><code>elseif (file_exists($_GET['page'].".php"))
</code></pre>

I can give the path <code>"../../../../etc/passwd"</code> (I know, that's kind of old, but it could be anything) and it would read the file (given enough permissions).

A simple fix could be:

<pre><code>elseif (file_exists(basename($_GET['page']) . ".php"))
</code></pre>

Don't forget to also apply the same thing for the actual <code>require</code>:

<pre><code>require basename($_GET['page']) . '.php';
</code></pre>

You could also apply <code>basename()</code> further up, so that you don't have to apply the function twice

See also: <a href="http://www.php.net/basename" rel="nofollow"><code>basename</code></a>

blocks|key|2457493|text|你的代码看起来不错。但是，如果您在使用之前也验证您的GET值，情况会更好。您可以检查它是数字的还是字母的，或者字母数字的。它可能是一个词或多个词。请根据您的要求进行检查。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2457494|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Your code looks good. But it would be better if you also validate your GET value before using. You can check whether it is numeric only or alphabets only or alphanumeric. It may be single word or multiple words. Check it as per your requirement.

blocks|key|1667891|text|这将包括所有允许的页面，因此$_GET'page‘==搜索将包括search.php，而$_GET'page’==将包括home.php+:]|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1667892|$allowed_pages+=+array('home',+'search',+'signup',+'signin',+'loggedin');
if(in_array($_GET["page"],+$allowed_pages))+{
++$page+=+$_GET["page"];+
}+else+{+
++$page+=+"home";+
}
++$page+=+str_replace('/',+'',+$page);

if(file_exists("page_includes/$page.php"))+{
++include("page_includes/$page.php");
}+else+{
++include("page_includes/home.php");
}|code-block|syntax|javascript|1667893|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

This will include all the allowed pages, so $_GET['page'] == search will include search.php, but $_GET['page'] == something will include home.php :]

<pre><code>$allowed_pages = array('home', 'search', 'signup', 'signin', 'loggedin');
if(in_array($_GET["page"], $allowed_pages)) {
 $page = $_GET["page"]; 
} else { 
 $page = "home"; 
}
 $page = str_replace('/', '', $page);

if(file_exists("page_includes/$page.php")) {
 include("page_includes/$page.php");
} else {
 include("page_includes/home.php");
}
</code></pre>

blocks|key|1667906|text|我会用白名单：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1667907|$all_pages+=+array(
++++'index'+=>+'index.php',
++++'about'+=>+'misc/about.php',
++++'404'+=>+'404.php',
++++...
);
function+reverse($filename)+{
++++/*+maps+filenames+to+page+names+*/
++++return+preg_replace('#/pages/(.*).php#',+'$1',+$filename);
}
/*+add+all+php+files+in+pages/+directory+to+$all_pages+*/
foreach+(glob("pages/*.php")+as+$filename)+{
++++$all_pages[reverse($filename)]+=+$filename;
}

/*+for+debugging:+make+sure+this+only+prints+stuffs+you+want+to+include+*/
/*+var_dump($all_pages);+*/

/*+the+actual+check+is+simple+*/
$page_name+=+isset($_GET['page'])+?+$_GET['page']+:+"index";
$include_name+=+isset($all_pages[$page_name])+?+$all_pages[$page_name]+:+"404";
require+$include_name;|code-block|syntax|javascript|1667908|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

I'd use a whitelist:

<pre><code>$all_pages = array(
 'index' =&gt; 'index.php',
 'about' =&gt; 'misc/about.php',
 '404' =&gt; '404.php',
 ...
);
function reverse($filename) {
 /* maps filenames to page names */
 return preg_replace('#/pages/(.*).php#', '$1', $filename);
}
/* add all php files in pages/ directory to $all_pages */
foreach (glob("pages/*.php") as $filename) {
 $all_pages[reverse($filename)] = $filename;
}

/* for debugging: make sure this only prints stuffs you want to include */
/* var_dump($all_pages); */

/* the actual check is simple */
$page_name = isset($_GET['page']) ? $_GET['page'] : "index";
$include_name = isset($all_pages[$page_name]) ? $all_pages[$page_name] : "404";
require $include_name;
</code></pre>

blocks|key|2457562|text|许多这些答案都忘记了空字节攻击。添加".php“以防止类似./etc/passwd之类的事情在许多部署中都不会起作用。这个问题只在PHP+5.3.4中得到了适当的解决。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2457563|entityMap|0|LINK|mutability|MUTABLE|url|http://projects.webappsec.org/w/page/13246949/Null%2520Byte%2520Injection|1|http://php.net/releases/5_3_4.php^0|A|5|0|1T|9|1|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]|$A|R|B|S|1|T]]|C|$]]|$1|D|3|-4|5|6|7|U|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]|L|$5|G|H|I|C|$J|M]]]]

A lot of these answers are forgetting about <a href="http://projects.webappsec.org/w/page/13246949/Null%20Byte%20Injection" rel="nofollow">null-byte attacks</a>. Appending ".php" to prevent things like ../../../../../etc/passwd will not work on many deployments. This issue was only fixed properly in <a href="http://php.net/releases/5_3_4.php" rel="nofollow">PHP 5.3.4</a>.

Basicaly, I've been working on a website for months now, and i'm about to open it. Before the opening I'm going over potential security issues, and i've made some research over the web to find what are the cummon security issues in php, I knew already how to fix most of them, although I really have an issue with one of them : I want to avoit using <code>include($_GET['page'])</code>, I've made some research but haven't found anything really handy to use, although is there any way I can just "secure" my code as it is? 
Here is what I've coded to prevent security issues:

<pre><code>if (!isset($_GET['page'])) 
{
echo redirect_tempo(500, 'index.php?page=home'); 
}
 elseif ($_GET['page']=="index") 
 {
 echo redirect_tempo(500, 'index.php?page=home'); 
 }
 elseif (file_exists($_GET['page'].".php"))
 {
 require $_GET['page'].'.php';
 }
 else 
 {
 echo redirect_tempo(500, 'index.php?page=404');
 }
</code></pre>

Note that <code>redirect_temp()</code> is basically just a <code>header()</code>.

Is this enough, can I improve it, or do I just need to completely change it?

Avoiding using include($_GET['page'])

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

基础，我已经在一个网站上工作了几个月了，我要打开它了。在开始之前，我将讨论潜在的安全问题，我已经在web上进行了一些研究，以找出php中的累积量安全问题是什么，我已经知道如何修复其中的大多数问题，尽管我确实有一个问题:我想避免使用include($_GET['page'])，我已经做了一些研究，但还没有找到任何有用的东...

问避免使用include($_GET['page'])
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问避免使用include($_GET['page'])EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问避免使用include($_GET['page'])
EN