Problems with Server-side Includes
asp.net, server-side, server-side-includes
Solution
If you include a file via a string variable: `<!--#include file=some_variable -->`, then depending on how that variable is filled there are possible attacks a hacker could do to include his own files and run arbitrary code on your machine. But as long as you use a string literal, you won't run into this problem.
I would use Master Pages in ASP.NET. This is the accepted way to have common areas of a page.
You would create a Master Page similarly as you would regular pages, then modification of each of the other pages would be minimal. Add a single line to the top of each page file, then specify the sections used.
Problem
I desperately want to use server-side includes in a project I'm working on because I just have some HTML that repeats and I need to get it on several pages. Must I use ascx or some other include technology... I mean, will lightning strike if I use server-side includes? My client -- the middle-person -- says "do what's easiest, this will probably be redone in a CMS soon anyway." Can I not use server-side includes? It's ASP.NET 2.0. Note: I feel this has been asked before, but I couldn't find it. If it has, please let me know and I will personally delete it, thanks! Edit: Any way to get an include ON ONE LINE would be fine with me, if you have suggestions. Edit: Why do I like includes? Include code: ``` !--#include file="inc_footer.aspx"--> ``` the same code for a control. First you need one of these ``` <%@ Register TagPrefix="a" TagName="HeyFooter" Src="inc_footer.ascx" %> ``` and then you can use it like this ``` <a:HeyFooter runat="server" /> ``` this is kind of long for what I need. Note Two security concerns with includes: 1) don't use the .inc extension, since it can be browsed. 2) do not include filenames based on user variables, as the best answer points o ut.