A secure dynamic PHP includes? - php

Question

How do I create a dynamic PHP includes, that is secure? for example I have an index.php file with header.php and footer.php included inside of it and then grab other pages inbetween using
index.php?page=about
If possible it would need to be dynamic so using arrays and case would be time consuming and require modifications.
I also want to be able to change the title of website as well depending on what page was included.
I currently have this in place:
<?php
require_once 'includes/config.php';
//Set values for page
$page_title = 'home page';
$current_page = 'home';
require_once 'includes/header.php';
?>
CONTENT
<?php
require_once 'includes/footer.php';
?>
Thanks
Would this be a safe way to include my pages?
if( isset( $_GET[ 'page' ] ) )
{
if( strpos( $_GET[ 'page' ], "/" ) )
{
$dir = substr( str_replace( ’’, ”, $_GET[ 'page' ] ), 0, strpos( $_GET[ 'page' ], "/" ) ) . "/";
$file = substr( strrchr( $_GET['page' ], "/" ), 1 );
if( file_exists( $dir.$file.".php" ) )
{
include( $dir.$file.".php" );
} else {
include( "home.php" );
}
} else {
if( file_exists( basename( $_GET[ 'page' ] ).".php" ) )
{
include( basename( $_GET[ 'page' ] ).".php");
} else {
include( "404.php" );
}
}
} else {
include( "home.php" );
}

Answer 1

To prevent errors and unauthorized file access (secure) to pages outside of your web directory or invalid pages you should do the following.
Validate $_GET['page'] by checking for periods. While periods may be valid in file names, it looks like you would be constructing the filename from the value and a period could indicate a breakout attempt to gain access to a root directory.
From there I would construct the filepath for the include, and then use file_exists to make sure it exists before including it.
As for the changing title for the page include I would do something like this:
<?php
$page_title = 'Default Title';
$page_to_include = 'default';
if( strpos($_GET['page'], '.') !== false ){
//throw/display error - could be a breakout attempt
}
if( !file_exists(sprintf('page_includes/%s.php', $_GET['page'])) ){
//requested page does not exists, throw or display error
}else{
$page_to_include = sprintf('page_includes/%s.php', $_GET['page']);
}
//do page validation here with file_exists
ob_start();
include $page_to_include;
$included_page = ob_get_clean(); //gets contents and cleans the buffer and closes it
require_once 'includes/header.php';
echo $included_page;
require_once 'includes/footer.php';
?>
This way the page is included first and stored in a buffer rather that output. It allows you included page to modify $page_title, and then that modified $page_title is available to the header.php script for output within the tags.

Answer 2

Just to change the title? Add this to your header.php
<title>
<?php
if(isset($_GET['page']) {
echo $_GET['page'];
} else {
echo 'My Site';
}
?>
</title>