PHP Code:
$page = $_GET['page'];
$path = "includes/";
$extension = '.php';
if (!$page) {
include 'default.php';
} else {
$filename = $path.$page.$extension;
include($filename);
}
This would keep files that shouldn't be access from being pulled up with it. Incase someone decided to get creative with your URL. Also, register_globals is
off by default in PHP 4.2.0 and later as a security measure. It's actually best to leave it as that and get variables through the superglobal arrays.