Here's what I would do:
PHP Code:
<?php
Session_Start();
if(!Array_Key_Exists('Language', $_SESSION)) $_SESSION['Language'] = 'English';
if(Array_Key_Exists('Language', $_GET) && Preg_Match('/^[A-Za-z\d\-]+$/', $_GET['Language']) && File_Exists("Languages/{$_GET['Language']}.php")){
$_SESSION['Language'] = $_GET['Language'];
}
$TranslateFile = "Languages/{$_SESSION['Language']}.php";
?>
That first sets the default if the session doesn't exist. If a session value already exists, it sticks to that unless a $_GET value is there. If the $_GET value is there, it first checks that the string is alphanumeric (accepts a dash too), and that the file exists. If both of those conditions are satisfied, it sets the language.
It's important to check that certain characters aren't included because using something like '?Language=../index.php' could try and require() Languages/../index.php, which is the same as just index.php. By making sure there are no dots or slashes, you're restricting them to the current directory - plus no language name would have those characters.
Off Topic:
Notice that I used the variable 'Language'. It's important to keep your variables well-named, and the variable 'Language' is more suitable as it's reason is for the language. I live in Wales so my 'local' value, by definition, would be 'Welsh'. However, I prefer to read and write in English (because I'm not fluent in Welsh), so my LANGUAGE would be 'English'.
Yeah, it doesn't really matter in the end, but it's nice to keep your variables well named, especially when you may want to make big changes a few months down the line... Looking at 'Local' you'd think 'What's that?', but looking at 'Language', it's obvious!
Bookmarks