title: PHP looking for a neat way to prevent unauthorised users from viewing pages
body: <p>I'm looking for a way to prevent unauthorised users from viewing pages without, lets say, wrapping everything in an <code>if authed { show page } else { show error}</code></p>
  
  <p>My website is currently setup like:</p>
  
  <p><b>index.php</b></p>
  
  <pre><code>require_once __WEBROOT__ . '/templates/default/header.tmpl';
  require_once content('p');
  require_once __WEBROOT__ . '/templates/default/footer.tmpl';
  </code></pre>
  
  <p><b>content()</b></p>
  
  <pre><code>function content($GETvar)
  {
     $content  = '';
     $root     = __WEBROOT__;
     $location = 'content';
     $files    = scanDirRecursive($root . '/content/');
  
     if (isset ($_GET[$GETvar]))
     {
        $path = str_replace('\\', '/', $_GET[$GETvar]-&gt;toHTML());
  
        if (in_array("$root/$location/$path", $files))
        {
           $content = "$root/$location/$path";
        }
        else
        {
           $content = $root . '/templates/default/errors/404.php';
        }
     }
     else
     {
        $content = __WEBROOT__ . '/content/home.php';
     }
  
     return $content;
  }
  </code></pre>
  
  <p>This works nicely. When I was playing around with auth options, I chucked in a 'return' at the top of 'content' page. Which ended up preventing the content page from loading but keeping the template in tact (unlike a die()).</p>
  
  <p>So I was wondering, is this safe? Or is there an error occurring that I'm not seeing...</p>