Suffering with php Injection PHP Injection

Question

Hello folks I am suffering a lot with php Injection and I believe that the vulnerability is in the codes below will be that could help me to end this.

<?php $page = ($_GET['loadpage'] == "") ? "main" : stripslashes($_GET['loadpage']);

?>

<div id="centro">
    <?
        if(file_exists($page.".html")){
            include($page.".html");
        }else{
            echo '<div class="completo"><div class="inner_box" align="center">Página não encontrada</div></div>';
        }
    ?>
</div>

Answer 1

Use the functions of satanização of PHP itself:
https://www.php.net/manual/en/function.filter-input.php

Example:

<?php
$page = filter_input(INPUT_GET, 'loadpage', FILTER_SANITIZE_URL || FILTER_VALIDATE_URL);
echo "Sua página: $page.\n";
?>

<div id="centro">
    <?
        if(file_exists($page.".html")){
            include($page.".html");
        }else{
            echo '<div class="completo"><div class="inner_box" align="center">Página não encontrada</div></div>';
        }
    ?>
</div>

Never use the global methods/functions: $_GET, $_POST, $_SERVER as you are doing, instead use the satanization functions, including there are two constants that you can pass in the third parameter, which is FILTER_VALIDATE_URL and FILTER_SANITIZE_URL.

Answer 2

Willian, first, always use Sanitize filters PHP to sanitize variables acquired by POST or GET.

Reference: https://www.php.net/manual/en/filter.filters.sanitize.php

To solve the problem of injections, you will have to map the inputs! Simply put, you can do so:

<?
    if(file_exists($page.".html")){
        if(in_array($page,array('pagina1','pagina2','pagina3'))){
             include($page.".html");
        } else {
             echo 'Você não tem permissão para acessar essa página';
        }
    } else {
        echo 'Página não encontrada';
    }
?>

However, these techniques are already consolidated in several PHP Frameworks, I suggest that if possible, you use one of these: Codeigniter or Laravel.

https://codeigniter.com

https://laravel.com