What are the potential security risks of using $_GET to pass CSS file names in PHP?

Using $_GET to pass CSS file names in PHP can pose security risks such as allowing for directory traversal attacks or injection of malicious code. To mitigate these risks, it is recommended to validate and sanitize the input before using it to include the CSS file. 

$css_file = isset($_GET['css_file']) ? basename($_GET['css_file']) : 'default.css';
$css_file_path = 'css/' . $css_file;

// Validate and sanitize the input
if (!file_exists($css_file_path)) {
    $css_file = 'default.css';
}

// Include the CSS file
echo '<link rel="stylesheet" type="text/css" href="' . $css_file_path . '">';

Keywords

$_GET security risks CSS file names PHP

Related Questions