What is the best practice for including a specific page using GET parameters in PHP?

When including a specific page using GET parameters in PHP, it is important to properly sanitize and validate the input to prevent security vulnerabilities such as SQL injection or cross-site scripting attacks. One way to do this is by using the `htmlspecialchars()` function to escape special characters in the input. Additionally, you should check if the input is valid before including the page to avoid errors. 

<?php
// Sanitize the GET parameter
$page = isset($_GET['page']) ? htmlspecialchars($_GET['page']) : 'default';

// Validate the input
$allowed_pages = ['page1', 'page2', 'page3'];
if (!in_array($page, $allowed_pages)) {
    $page = 'default';
}

// Include the specific page
include $page . '.php';
?>

Keywords

PHP GET parameters include URL security

Related Questions