include handler function

[fantomel]

Hello i'm trying to build a simple handler function for including files from different directorys what kind of security checking should i do before including the file ? any advices?

[premiso]

How are you determining the file the include? If it is from GET/POST you should check that the file_exists before doing any includes. Also if you do not use file_get_contents to fetch data from a URL you should turn off url_fopen (something like that) to prevent someone executing their own code from a url just incase.

 

If you are not planning on doing a "dynamic" include with GET data, you do not need to worry about security as long as you define any variables that you may be using to include the file you should be fine.