PHP如何根据URL参数自动调用对应脚本（无需逐个判断）

Hey there! I totally get wanting to avoid writing a million if/else checks for every possible script you might want to include. The good news is you can do this dynamically—you just need to grab the relevant parameter from the URL, validate it properly (super important for security!), and then include the script. Let's break this down with examples.

First, let's clarify two common URL structures you might be using, since your question mentions sitename.com/sitepage?script1 (where the query string is just the script name). I'll cover both that scenario and a cleaner named parameter approach (which I recommend for clarity).

Option 1: Using a Named Parameter (Recommended) #

This uses a URL like sitename.com/sitepage?script=script1 where script is the parameter key, and script1 is the value pointing to script1.php. Here's how to implement it:

<?php
// Check if the 'script' parameter exists in the URL
if (isset($_GET['script'])) {
    // Grab the requested script name
    $requestedScript = $_GET['script'];
    
    // 🔒 Critical: Define a whitelist of allowed scripts
    // Only these scripts can be included—prevents malicious requests
    $allowedScripts = ['script1', 'script2', 'script3', 'user-dashboard'];
    
    // Make sure the requested script is on our allowed list
    if (in_array($requestedScript, $allowedScripts)) {
        // Sanitize to block directory traversal attacks (e.g., ../../bad-file)
        $sanitizedScript = basename($requestedScript) . '.php';
        
        // Include the valid script
        include $sanitizedScript;
    } else {
        // Handle invalid requests
        echo "Sorry, that script isn't available.";
    }
}
// If no parameter is present, we do nothing (as per your requirement)
?>

Option 2: Using Raw Query String (Your Original URL Structure) #

If you want to stick with URLs like sitename.com/sitepage?script1 (where the entire query string is the script name), you can use $_SERVER['QUERY_STRING'] to get that value:

<?php
$queryString = trim($_SERVER['QUERY_STRING']);

// Only proceed if there's a query string present
if (!empty($queryString)) {
    $requestedScript = $queryString;
    
    // Same security checks as above—never skip these!
    $allowedScripts = ['script1', 'script2', 'script3'];
    
    if (in_array($requestedScript, $allowedScripts)) {
        $sanitizedScript = basename($requestedScript) . '.php';
        include $sanitizedScript;
    } else {
        echo "Invalid script request.";
    }
}
?>

Why Security Matters So Much #

I can't stress this enough: never skip the whitelist and sanitization steps. Without them, an attacker could request something like ?../../malicious-script to include files outside your intended directory, which is a huge security risk. Using basename() strips any directory paths, and the whitelist ensures only your approved scripts are ever included.

Extra Tips #

• If your scripts are in a subfolder (like scripts/script1.php), adjust the include path: include "scripts/" . $sanitizedScript;
• If users might add the .php extension in the URL (e.g., ?script=script1.php), strip it first: $requestedScript = str_replace('.php', '', $_GET['script']);

内容的提问来源于stack exchange，提问作者issie devi