Sanitized PHP Include Navigation through GET variable

We all have heard about the Remote File Inclusions, LFI, sql injections and all the other nasty variations of php “hacking”.
This mainly happens because people code pages without being aware of the security of their product.

In this tutorial I will explain how to sanitize a GET variable.
This programming design is used to build pages without using iframes or frames and to optimize the homepage for search engines.
An url usually looks like www.domain.com/index.php?p=about .

include $_GET['page'];

Let’s take this piece of code for example, a normal url would look like www.domain.com/index.php?page=about.php. Now, an attacker could exploit this by simply changing the about.php into some shellcode like c99 or r57.
He would include an evil piece of code that is often used to deface homepages.
The solution to this problem would be to check if the file exists, and if it doesn’t, then it should include an error page.

We can use a function in PHP called file_exists.

file_exists($file);

It basically checks if the file exists in the current folder or not.

$file = $_GET['page'].'.php';
if (file_exists($file)) {
   include $file;
}else{
   echo 'Error';
}

This would already do the job.
You could also filter the forward slashes (/) and the double-dots(..) and delete them from $file.

The only problem is that the evil user can access all your files trough the ?page=”page here”.
We can define which pages we want to allow with an array. This is a quite simple task to do with PHP, god bless those useful functions, I mainly code in Pascal (at school) and pascal has very few really useful functions…
We define an array with all the pages we want to allow and then use the function in_array.
We could also check if there are symbols such as / and .. inside the requested page and delete them.
This is the syntax for the str_replace function.

str_replace ("Text to find","Replace by",$_GET["page"]);

The check would look like this

  $allowed = array('page1','page2','page3');
  $selection = str_replace ('..','',$_GET['page']);
  $selection = str_replace ('/','',$_GET['page']);
  if(in_array($selection,$allowed) && file_exists($selection)){
    include $selection;
  }
  }else{
    echo 'error, unauthorized page';
  }