Include safety

Question

<?php
if (preg_match('/^[a-z0-9]+$/', $_GET['page'])) {
$page = realpath('includes/'.$_GET['page'].'.php');
$tpl = realpath('templates/'.$_GET['page'].'.html');
if ($page && $tpl) {
    include $page;
    include $tpl;
} else {
    // log error!
}
} else {
// log error!
}
?>

How safe would you say this is? Gumbo here on Stack Overflow wrote it.
Dynamic Include Safety

I wanna hear your opinions.

cheers

Answer 1

My first thought isn't about safety, but about why in the world would you do that?

Answer 2

I could see some potential issues there, especially if the 'page' variable contained '..' or other such things that could allow them to see something they weren't supposed to be able to see.

I do something similar on a few sites of mine, but I would first check 'page' to make sure it references one of a set of allowed pages.

Answer 3

you including your own code. how safe is it?

Answer 4

I'd say it's pretty safe. Just don't allow anything to write to those folders. PHP files are traditionally inside the web root of a server which is dangerous to start with. It would be better to place the files being loaded to an area that's absolutely inaccessible to the outside given a configuration error or a .htaccess file going missing.