Best way to avoid code injection in PHP

by

Use a whitelist and make sure the page is in the whitelist:

  $whitelist = array('home', 'page');

  if (in_array($_GET['page'], $whitelist)) {
        include($_GET['page'].'.php');
  } else {
        include('home.php');
  }

More Related Contents:

  1. PHP MySQLI Prevent SQL Injection [duplicate]
  2. How can I secure my source code [closed]
  3. Are PDO prepared statements sufficient to prevent SQL injection?
  4. Is “mysqli_real_escape_string” enough to avoid SQL injection or other SQL attacks?
  5. Why would one omit the close tag?
  6. How to secure database passwords in PHP?
  7. Reference: What is a perfect code sample using the MySQL extension? [closed]
  8. The ultimate clean/secure function
  9. How to encrypt/decrypt data in php?
  10. Exploitable PHP functions
  11. Preventing Directory Traversal in PHP but allowing paths
  12. What is the best way to stop people hacking the PHP-based highscore table of a Flash game
  13. preventing csrf in php
  14. Generating cryptographically secure tokens
  15. Which $_SERVER variables are safe?
  16. How to best store user information and user login and password
  17. What do I need to store in the php session when user logged in?
  18. PHP setcookie “SameSite=Strict”?
  19. Magic quotes in PHP
  20. Is it ever ok to store password in plain text in a php variable or php constant?
  21. How do you set up use HttpOnly cookies in PHP
  22. Fastest hash for non-cryptographic uses?
  23. Is it secure to store a password in a session? [duplicate]
  24. What security problems could come from exposing phpinfo() to end users?
  25. Set httpOnly and secure on PHPSESSID cookie in PHP
  26. Does PHP’s $_REQUEST method have a security problem?
  27. is $_SERVER[‘HTTP_REFERER’] safe?
  28. Json: PHP to JavaScript safe or not?
  29. Limiting user login attempts in PHP [duplicate]
  30. What encryption algorithm is best for encrypting cookies?

Leave a Comment