What are some alternatives to including PHP files using $_GET parameters without having to create a list of allowed pages?

When including PHP files using $_GET parameters, it is important to ensure that only valid and allowed pages are included to prevent security vulnerabilities such as directory traversal attacks. One alternative to creating a list of allowed pages is to use a switch statement to determine which file to include based on the value of the $_GET parameter. This way, you can control which files can be included without explicitly listing them. 

<?php
$page = isset($_GET['page']) ? $_GET['page'] : 'default';

switch ($page) {
    case 'about':
        include 'about.php';
        break;
    case 'contact':
        include 'contact.php';
        break;
    default:
        include 'default.php';
        break;
}
?>

Keywords

PHP include require file path security

Related Questions