Member Avatar for joshua.tilson

Hello,

I am looking for some advice on how to do something within PHP, i know it is possible and have seen examples before, however I am not sure how to implement this myself.

What i am looking at doing is including PHP pages within a main PHP page.
for instance i have index.php and i want to include contacts.php inside the index page.
the url looks something like this:

My questions is what is this called? and where can i learn about doing it effectively.

I have used Include() and Include_Once() before and this is not the same thing.

Any one have any ideas for me?

Thank you for your time!

  • 3 Contributors
  • 3 Replies
  • 138 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by chrelad

Dani AI

Generated

Thread summary and secure, maintainable pattern

The thread shows three common patterns: a direct dynamic include (), a switch/router in index.php (), and a quick regex guard (). All work, but they leave gaps around security and maintainability — specifically directory traversal, accidental remote file inclusion, and brittle growth as pages increase. A safer, pragmatic approach is to use a small allowlist (map logical keys to explicit file paths), validate the request with PHP filters, resolve the target with real paths, and then include only resolved files from a known directory.

Example allowlist + resolution (drop this into index.php — pages live in a dedicated pages/ folder):

<?php
$pages = [
  'home'     => __DIR__ . '/pages/home.php',
  'contacts' => __DIR__ . '/pages/contacts.php',
  'about'    => __DIR__ . '/pages/about.php',
];

$requested = filter_input(INPUT_GET, 'p', FILTER_SANITIZE_STRING) ?: 'home';
$path = $pages[$requested] ?? $pages['home'];

$base = realpath(__DIR__ . '/pages') . DIRECTORY_SEPARATOR;
$resolved = realpath($path);

if ($resolved === false || strpos($resolved, $base) !== 0) {
    // invalid request — use a safe fallback or serve a 404
    http_response_code(404);
    require_once $pages['home'];
    exit;
}

require_once $resolved;

Practical notes

  • Never include raw user input as a filename. Use a whitelist map so keys (like "contacts") are the only allowed values.
  • Use realpath()/base-dir checks to prevent ../ traversal.
  • Prefer require_once for required templates; include only raises a warning, require causes a fatal error if missing.
  • Disable allow_url_include on the server to avoid remote file inclusion.
  • For larger projects consider a router/library or a micro-framework to separate routing from rendering.

References: [include()] (https://www.php.net/manual/en/function.include.php), [filter_input()] (https://www.php.net/manual/en/function.filter-input.php), [realpath()] (https://www.php.net/manual/en/function.realpath.php), [allow_url_include] (https://www.php.net/manual/en/ini.core.php#ini.allow-url-include)

Recommended Answers

All 3 Replies

Member Avatar for MitkOK

Hi.
You can do this like this :

<?php

$file = $_GET['t'].".php";
include ($file);

?>

This will include contacts.php in your index.php :cool:

commented: Thanks for the ideas man! +1
Member Avatar for joshua.tilson

Awesome Thanks. This is close to what i did any way.

I used links like:

<a href="index.php?p=contacts">Contacts</a>

then i have a Switch Case:

switch ($_GET[p]) {
case("contacts"):
require: "contacts.php";
break;
}

Thanks for the help!


For all those noobs out there like me:

In the URL when there is a ? after the page name as in my index.php?p=contacts
the PHP will read the following Information as a $_GET.
thus when i $_GET[p] the page reads the following from after ? and will interpret it from there..
If any one can make this any clearer please help!

Member Avatar for chrelad

Hi joshua.tilson,

It appears that this can be streamlined even more, however, you will have to put some safegaurds in to make sure there is no fowl play (which should be done anyway). This is what it could be:

<?php

require((preg_match('/(contacts|about|home)/i',$_GET['p'])) ? $_GET['p'] : 'fowlplay.php');

?>
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.