Having problem with php include conflict

[Seraphic]

Hi,

I'm having a problem with the below php include conflict.

If I try to use Code #1, Code #2 will no longer work and then returns the below error.

Code #1 is used to integrate a phpBB3 login script into my website. Code #2 is used for navigation on my website. So I need both, but when trying to use both codes, there are problems.

Could anyone please offer some ideas on to how to allows these codes to work together?

Thanks

Code #1 (index.php starting at line one)

<?php
define('IN_PHPBB', true);
$phpbb_root_path = '../forums/';
$phpEx = substr(strrchr(__FILE__, '.'), 1);
include($phpbb_root_path . 'common.'.$phpEx);
//
// Start session management
//
$user->session_begin();
$auth->acl($user->data);
$user->setup();
//
// End session management
//
?>

Code #2 (index.php on line 1433)

<?php include ("$id"); ?>

Error: (using index.php?id=contact.php)

[phpBB Debug] PHP Notice: in file /index.php on line 1433: main() [function.include]: Failed opening '' for inclusion (include_path='.:/usr/local/lib/php')

 

[tim_m]

for code 2 try

<?php include $_GET['id']; ?>

note that you really should check that $_GET['id'] is valid before blindly accepting it. you could also try renaming the get variable so it would be something like index.php?page=contact.php

 

[Seraphic]

for code 2 try

<?php include $_GET['id']; ?>

note that you really should check that $_GET['id'] is valid before blindly accepting it. you could also try renaming the get variable so it would be something like index.php?page=contact.php

Yeah, a user at the phpbb forums also suggested trying that. But he added that would be "insecure and dangerous"...

That means you'll have to use $id = $_GET["id"]; somewhere as well. Note, however, that this method is very insecure and dangerous and is a very, very bad practice.

Edit:

Just tried using "<?php include $_GET['id']; ?>" and it works without error when using both codes. Now the question is, how "safe" is it?

 

[Dyslexic_Dog]

It's not safe at all. If someone figures out what you are doing they'll be able to load any file that want into your PHP engine. If you have an image upload service on your server I would be able to load files onto your server and send them through the PHP processor.

 

[surazal]

Don't include directly from a GET variable, that's a big security risk. A safer method is to have the GET variable hold a name of the page you want to load, then use a switch statement or a series of if statements to load the correct filename.

for example:

switch( $_GET["id"] ) {

case "contacts":
     include("contact.php");
     break;

     //add more pages

default:
     //unexpected value, dont load anything
}