PHP Including a file based on pathinfo - security concern? -

i redirecting page requests through file called index.php looks @ url visitor requested , sees if there template file match.

for example, http://www.website.com/contact route index.php script , should check see if file /var/html/template/contact.tpl exists , include if does.

my concern regards security , null characters, dots , slashes, etc. kind of filter need applying code below or use of pathinfo , directory prefix enough? don't want able maliciously include files outside of designated template directory.

<?php  define ('templates', '/var/html/templates');  $page = pathinfo ($_server['request_uri'], pathinfo_filename);  if (file_exists (templates . '/' . $page . '.tpl')) {     include (templates . '/' . $page . '.tpl'); } else {     header ('http/1.0 404 not found');     echo 'sorry page not found'; }  ?> 

to 100% safe, make list of allowed pages , check it's in array before returning page.

you try php glob() e.g..

define ('templates', '/var/html/templates/');  $page = templates . pathinfo($_server['request_uri'], pathinfo_filename) . '.tpl';  if (in_array($page, glob(templates . '*.tpl'))) {     include ($page); } else {     header ('http/1.0 404 not found');     echo 'sorry page not found'; } 

this validate it's in folder , extension '.tpl'

sorry - edited make glob() behaviour correct.