What are the potential security risks of using $_GET in PHP includes?

Using $_GET in PHP includes can pose security risks such as SQL injection and cross-site scripting attacks if the input is not properly sanitized. To mitigate these risks, always validate and sanitize any input received via $_GET before using it in includes or other parts of the code. 

// Example of how to sanitize input from $_GET before using it in includes
$id = isset($_GET['id']) ? filter_var($_GET['id'], FILTER_SANITIZE_NUMBER_INT) : null;
if ($id !== null) {
    include 'page_' . $id . '.php';
} else {
    // Handle invalid input
}

Keywords

$_GET security risks PHP includes injection attacks data validation

Related Questions