Notice: Undefined index: option in on a isset

[mrooks1984]

hi i am getting this message on a isset and not sure how to fix it

 

Notice: Undefined index: option in

 

<?php
  $option = $_GET['option'];
  $path = 'option/';
  $extension = '.php';
  
  if ( preg_match("#^[a-z0-9_]+$#i",$option) ){
    $filename = $path.$option.$extension;
    include($filename);
  }
?>

hope someone can help, please.

[awjudd]

It is happening because the $_GET variable 'option' doesn't exist (i.e. it is not in your query string).

 

You can resolve this by doing something like ...

$option = '';
if (  isset ( $_GET [ 'option' ] ) ) 
{
    $option = $_GET['option'];
}

 

That said, this is a fairly big security risk leaving it open like this ...

 

~juddster

[mrooks1984]

thanks for your help, so what would  i need to add to the code to make it secure.

[ManiacDan]

I find it odd that your thread title includes the answer to your problem.  You said you were getting that error on an isset...but isset was the solution to your error.

 

Anyway, don't include files based on user input.  Use a switch statement with hard-coded include values to make sure the user hasn't figured out some way of including custom code on your site. 

 

-Dan