What are the potential risks of using include statements with unfiltered GET parameters in PHP?

Using unfiltered GET parameters in include statements in PHP can lead to security vulnerabilities such as remote code execution or file inclusion attacks. To mitigate this risk, it is important to sanitize and validate any user input before using it in include statements. This can be done by using functions like filter_input() or validating the input against a whitelist of allowed values. 

$filename = filter_input(INPUT_GET, 'filename', FILTER_SANITIZE_STRING);
if ($filename && in_array($filename, ['file1.php', 'file2.php'])) {
    include $filename;
} else {
    echo 'Invalid filename';
}

Keywords

include statements unfiltered GET parameters PHP security vulnerability code injection

Related Questions