I've been reading a project (not based on any PHP framework) and I met the following (procedural) code on nearly every PHP file that responds to user requests (either $_GET
or $_POST
).
if ($_REQUEST['a']){
$func="a_".$_REQUEST['a'];
if (function_exists($func)){
$func();
}else{
// redirect
}
}else{
// redirect
}
...
a_action_a() { ... }
a_action_b() { ... }
I'm interested in knowing if it is secure enough (or even better what are the threats) as a mechanism for function calling. Can this code lead to control-flow or function enumeration?
Is there a proper way or suggested mechanisms for function calling in procedural PHP?