Posted by Nick DeNardis on 12/16/04 11:58

You are probably going to want to check the variable before shoving it
into the include, the URL looks a little suspicious with the ".php"'s
on in the get variables, it is not wrong but you may want to prevent
anyone from trying to take advantage of your script.

Something like this may suit you better:

<?php
// Create the include list
$includes = array();
// Fill it with the GET variables requested
$includes[] = trim($_GET['var1']);
$includes[] = trim($_GET['var2']);
// Loop through each file to include, verify it and include it
foreach($includes as $file)
if ($file != '' && is_file($file . '.php'))
include($file . '.php');
?>

Dave Kelly wrote:
> From a html page menu I need to pass 2 variables.
>
> <a
> href="signup.php?var1=list-PINSS.php&var2=blurb-PINSS.php"><h3>Padre
> Island National Sea Shore</h3></a><br>
>
> These go to a php web page and are used thusly.
>
> <?php include ($_SERVER["var2"]); ?> //this is line 3
> <?php include ($_SERVER["var1"]); ?> // line 5
>
> I am getting these error:
>
>
> Notice: Undefined index: var2 in
> /var/www/vhosts/texasflyfishers.org/httpdocs/signup.php on line 3
>
> Warning: main(): Failed opening '' for inclusion
> (include_path='.:/usr/share/pear') in
> /var/www/vhosts/texasflyfishers.org/httpdocs/signup.php on line 3
>
>
> Notice: Undefined index: var1 in
> /var/www/vhosts/texasflyfishers.org/httpdocs/signup.php on line 5
>
> Warning: main(): Failed opening '' for inclusion
> (include_path='.:/usr/share/pear') in
> /var/www/vhosts/texasflyfishers.org/httpdocs/signup.php on line 5
>
> What am I doing wrong?
>
> TIA
> Dave

[Back to original message]