PHP多语言切换异常：非法语言参数显示常量名而非值

Hey there, I see the issue here—when an invalid language parameter is passed, your code tries to include a non-existent language file, which means constants like _TITLE never get defined, so they just show up as plain text. Let's fix this by adding validation to ensure we only use allowed languages, falling back to English if anything invalid comes in.

Here's the revised code with proper validation:

<?php
session_start();

// Define allowed languages - add/remove as needed based on your supported languages
$allowed_languages = ['en', 'zh', 'es']; 
$default_lang = 'en';

// Handle language parameter from GET request
if(isset($_GET['lang']) && !empty($_GET['lang'])){
    // Normalize input to lowercase and trim whitespace
    $selected_lang = trim(strtolower($_GET['lang']));
    
    // Check if the selected language is in our allowed list
    if(in_array($selected_lang, $allowed_languages)){
        $_SESSION['lang'] = $selected_lang;
    } else {
        // Invalid language provided, reset to default English
        $_SESSION['lang'] = $default_lang;
    }
    
    // Reload the page only if the language actually changed
    if(isset($_SESSION['lang']) && $_SESSION['lang'] != $selected_lang){
        echo "<script type='text/javascript'> location.reload(); </script>";
    }
}

// Determine the final language to use (fallback to default if session has invalid data)
$current_lang = isset($_SESSION['lang']) && in_array($_SESSION['lang'], $allowed_languages) 
    ? $_SESSION['lang'] 
    : $default_lang;

// Include the valid language file
include "lang_".$current_lang.".php";
?>

Key improvements made: #

• Allowed Languages Whitelist: We defined $allowed_languages to restrict which languages are acceptable. This not only fixes your original issue but also adds a security layer against arbitrary file inclusion risks.
• Input Normalization & Validation: We convert the input to lowercase and trim whitespace, then check if it exists in our allowed list. Invalid values trigger a reset to the default language.
• Fallback Safety: Even if the session has leftover invalid language data (from old tests or user tampering), we still enforce the default English to prevent broken constant rendering.
• No Broken File Includes: Since we only use languages from our predefined list, we never attempt to include non-existent files like lang_enASa.php.

Your existing lang_en.php stays unchanged:

<?php
define("_TITLE", "Title");
// Add other language constants here as needed
?>

Now when someone passes an invalid parameter like ?lang=enASa, the code will automatically switch to English, and your constants will render correctly instead of showing raw constant names.

内容的提问来源于stack exchange，提问作者user9870819