Possible to translate HTML into PHP?

[Repres3nt]

Hehe glad to hear it, but you should not forget to remove the extensions in the $forbidden array.. I kinda did that wrong.

So it should be:

//The pages that are not allowed to be reached by the visitor 
$forbidden = array('config', 'settings');

Oh right because you add them here..

   include($section.'.php');
else
   include('index.php');

Well, either way I hope we solved his problem.

 

[Apolva]

The following is simpler and more secure:
(Need to put the pages in /pages/ directory)

<?php
$file = "pages/".preg_replace('#([^a-zA-Z0-9_-]+)#','',$_GET['p']).".php";
if(file_exists($file)) include($file);
else include("pages/404.php");
?>

?p=something will include pages/something.php (if it exists, otherwise pages/404.php).

 

[Broken.]

Just save the file as a php file. Like this: index.php instead of index.html.

 

[gmbblokus]

I'm pretty sure I would know that. Also Repres3nt your idea still created the same problem.

 

[Apolva]

If you went with repres3nt's method, you should whitelist the pages rather than blacklist them

otherwise, for example:
?p=../../.htpasswd(null-byte)

could output a directory's password, etc.