What is the issue with embedding files using "?loc=" in PHP?

Using "?loc=" in PHP for embedding files can pose a security risk as it allows users to access files outside of the intended directory. To solve this issue, it is recommended to use a whitelist approach where only specific files within a designated directory can be accessed. 

$allowed_files = array("file1.php", "file2.php", "file3.php");
$requested_file = $_GET['loc'];

if (in_array($requested_file, $allowed_files)) {
    include($requested_file);
} else {
    echo "File not found.";
}

Keywords

embedding files ?loc= PHP include file path

Related Questions