burrone

<?php
 if(!empty($_GET['page']))
 {
  include($_GET['page']);
 }
 else
 {
  include('home.php');
 }
?>

$page = 'home.php';

$allowedPages = array('one.php', 'two.php', ...);

if (!empty($_GET['page']) && in_array($_GET['page'], $allowedPages))
    $page = $_GET['page'];

include $page;

define('DEFAULT_PAGE', 'home.php');
define('ALLOWED_PAGES_EXPRESSION', '^[/]+.php$|^[/]+.html$');

function ValidateRequestedPage($p)
{
    $errors_found = False;

        // Make sure this isn't someone trying to reference directories absolutely.
    if (preg_match('^/.+$', $p))
    {
        $errors_found = True;
    }

        // Disable access to hidden files (IE, .htaccess), and parent directory.
    if (preg_match('^..+$', $p))
    {
        $errors_found = True;
    }


        // This shouldn't be needed for secure servers, but test for remote includes just in case...
    if (preg_match('.+://.+', $p))
    {
        $errors_found = True;
    }

    if (!preg_match(ALLOWED_PAGES_EXPRESSION, $p))
    {
        $errors_found = True;
    }

    return !$errors_found;
}

if (!isset($_GET['page'])) { $page = DEFAULT_PAGE; }
else { $page = $_GET['page']; }

if ( !ValidateRequestedPage($page) )
{
    /* This is called when an error has occured on the page check. You probably
       want to show a 404 here instead of returning False. */
    return False;
}

// This suggests that a valid page is being used.
require_once($page);

define('DEFAULT_PAGE', 'home.php');
define('ALLOWED_PAGES_EXPRESSION', '^[/]+.php$|^[/]+.html$');

function ValidateRequestedPage($p)
{
    $errors_found = False;

        // Make sure this isn't someone trying to reference directories absolutely.
    if (preg_match('^/.+$', $p))
    {
        $errors_found = True;
    }

        // Disable access to hidden files (IE, .htaccess), and parent directory.
    if (preg_match('^..+$', $p))
    {
        $errors_found = True;
    }


        // This shouldn't be needed for secure servers, but test for remote includes just in case...
    if (preg_match('.+://.+', $p))
    {
        $errors_found = True;
    }

    if (!preg_match(ALLOWED_PAGES_EXPRESSION, $p))
    {
        $errors_found = True;
    }

    return !$errors_found;
}

if (!isset($_GET['page'])) { $page = DEFAULT_PAGE; }
else { $page = $_GET['page']; }

if ( !ValidateRequestedPage($page) )
{
    /* This is called when an error has occured on the page check. You probably
       want to show a 404 here instead of returning False. */
    return False;
}

// This suggests that a valid page is being used.
require_once($page);