include file using array in php

Question

I have two files to be included in the index.php. One is config.php and the other is db.php. I used

<?php include 'config.php'
include 'db.php' ?>

Tested on a vulnerability scanner rips. It says Userinput reaches sensitive sink. include include ('config.php'). Proof of concept /index.php?file=../../../../../../../etc/passwd.

The suggestion is

$files = array("index.php", "main.php");  
if(!in_array($_GET["file"], $ files)) exit;

Can you anyone please explain how to add config.php and db.php according the suggestion above?. I have both my files in an include folder.

Can anyone have look at http://cxsecurity.com/issue/WLB-2011040079 .

Answer 1

The suggestion you received is that you hard-code a list of valid values for $_GET['file'] and then check user input against that list. If you'd like to allow additional files, simply add them to the list:

$files = array("index.php","main.php","config.php","db.php");

I'm not sure if this will help you pass whatever vulnerability test you are running, but it will ensure that only files you deliberately list will be included.