help including a page using $_GET

[electricocean]

Hi, I am having some problems including a page thru the $_GET var. I have been doing this on every page of my site and it has worked fine. But This page i am trying to include has a?id= at the end of the url.

index.php?pageinclude=pages/about.php?id=5

so i am trying to include a page on my index.php. When i try this i always get my error 'page cannot be found'. I have also tried ?pageinclude=pages/about.php w/o the $_GET var and i got this error:

SecureSSI: The Script (/usr/export/www/hosting/dkicks/index.php) has tried outside from their user-draw-eats the file../mysql_connect.php to access.
This is not permitted!

what does this mean?

I really need help on this.
thanks,
electricocean

[mcibor]

How are you including the file?

include($_GET['pageinclude']); //?

I would change the? and = to some string, eg.

<?php
$from = array("?", "=", "/", "\\");
$to = array("%1", "%2", "%3", "%4"); // just special characters

$link = "pages/about.php?id=5";
$a = str_replace($from, $to, $link);
?>
<a href="index.php?pageinclude=<? echo $a;?>">Click</a>

And in the receive file:

<?php
$to = array("?", "=", "/", "\\");
$from = array("%1", "%2", "%3", "%4"); // just special characters

$link = str_replace($from, $to, $_GET['pageinclude']);
if(check_if_url_inside_domain_and_correct($link))
{
include($link);
}

Hope this helps!
Michal Cibor

[electricocean]

Hi Thhanks,.

I am confused about what i put in the receive file.

what is 'check_if_url_inside_domain_and_correct'?
i looked on the php.net and found nothing.

thanks.