php - include a page selected in URL with $_GET
232
I want to create a page who's including himself the selected page choose in URL (example :index.php?p=signin
with protection. Can I secure more my page?
I don't secure the text from$_GET['p']
against injection. I just want to know if its dangerous or not with this method or not ?
$grantLevel = [
'Banned' => 0 ,
'Guest' => 1 ,
'Trial' => 2 ,
'Normal' => 4 ,
'Premium' => 8 ,
'Moderator' => 16 ,
'Administrator' => 32 ,
'SuperAdministrator' => 64
] ;
$pages = [
'ban' => $grantLevel['Banned'] ,
'error' => $grantLevel['Guest'] ,
'forbidden' => $grantLevel['Guest'] ,
'manage' => $grantLevel['Administrator'] ,
'signin' => $grantLevel['Guest'] ,
'welcome' => $grantLevel['Guest'] ,
];
$accountLevel = $_SESSION['accountLevel'] ;
if($accountLevel != $grantLevel['Banned']){
if(isset($_GET['p'])) {
if($accountLevel >= $pages[ $_GET['p']]) {
$p = $_GET['p'] ;
} else {
$p = 'forbidden' ;
}
} else {
$p = 'error' ;
}
} else {
$p = 'ban' ;
}
require( $p . '.php') ;