通过PHP中的include包含文件

Question

Basically, I'm currently in the process of developing some form of Framework , It's going to have a main index file that'll control the pages that are displayed, I'll then include files based on the URL that is rewritten using .htaccess , so my .htaccess would look something like this.

Options +FollowSymlinks -MultiViews

AddType "text/html; charset=UTF-8" html 
AddType "text/plain; charset=UTF-8" txt 

<IfModule mod_rewrite.c> 
    RewriteEngine On 
    RewriteBase / 

    # if file not exists 
    RewriteCond %{REQUEST_FILENAME} !-f

    # if dir not exists     
    RewriteCond %{REQUEST_FILENAME} !-d

    # avoid 404s of missing assets in our script 
    RewriteCond %{REQUEST_URI} !^.*\.(jpe?g|png|gif|css|js)$ [NC] 

    # core framework url rewriting 
    RewriteRule ^ index.php [L]
<IfModule mod_rewrite.c> 

While keeping in mind that I have this line RewriteRule ^ index.php [L] I'd then use the following in my index.php

define("PAGES", $_SERVER['DOCUMENT_ROOT']."/pages");

$uri = explode("/",substr($_SERVER['REQUEST_URI'],1));
if((isset($uri[0])) && ($uri[0]!="")) {$page = $uri[0];} else {$page = "login";}

if(is_file(PAGES."/$page/$page.php")) {
    include(PAGES."/$page/$page.php");
} else {
    include(PAGES."/error_pages/404.php");
}

Would this be deemed as secure enough? or would this provide the ability for some form of exploit to be done?

Answer 1

更好的解决方案是使用PHP> = 5.3的名称空间和自动加载功能，直到用户无法在DOCUMENT_ROOT中创建自己的文件并且您应避免将文件包含在DOCUMENT_ROOT中的可能性之前，您的解决方案才是安全的。