On 8 Aug 2011, at 22:56, Beth Lee wrote: […] The htmlentities() call is unnecessary (and wrong) because once you know it's either "products", "about", or "contact", you also know it doesn't have any entities, and in any case htmlentities() escapes HTML, not filenames. :) One simpler approach is to make each page its own PHP file with its own URL (e.g. http://example.com/products.php), and then use something like (shameless self-promotion) https://github.com/inanimatt/kisskiss-light to wrap the current page's content in a template. Then you're not taking user input to derive a file to load, and you can wrap pages in a template just by doing a require() at the top of each page. But really, if you're serving flat content in a template you could avoid PHP entirely and generate your pages offline (if they aren't dynamic) then upload. For most basic sites, using PHP is wasteful and way over the top. :) It breaks HTTP caching, and massively reduces the amount of load you can handle. If you generate offline, you still have the advantage of being able to keep your template and content separate, but you aren't pointlessly regenerating them for each request when they probably only update at most a few times a day.