Skip to content
PHP Logo

What are the potential security risks associated with using user input directly in PHP include statements?

Using user input directly in PHP include statements can lead to security risks such as directory traversal attacks, allowing malicious users to access sensitive files on the server. To mitigate this risk, it is crucial to sanitize and validate user input before using it in include statements.

php 
$user_input = $_GET['page']; // Example user input

// Sanitize and validate user input
if (preg_match('/^[a-zA-Z0-9_\-]+$/', $user_input)) {
    $page = 'pages/' . $user_input . '.php';
    include $page;
} else {
    echo 'Invalid input';
}

Related questions