File inclusion from user input
Why it matters
Building include paths from input lets attackers load system files, uploaded images containing PHP or remote code. It is one of the fastest routes to a full server takeover.
include $_GET['page'] . '.php';$pages = ['home' => 'home.php', 'about' => 'about.php'];
$page = $pages[$_GET['page'] ?? 'home'] ?? 'home.php';
include __DIR__ . '/pages/' . $page;How to fix
Map allowed page names to fixed files with a whitelist array. Never build include paths from request data.
Scan my code
Scan my code β
Paste a file and PHP Safe points to every line that matches this rule.