. $slug = isset($_GET['slug']) ? trim($_GET['slug']) : ''; header('Content-Type: text/html; charset=UTF-8'); if ($slug === '') { readfile(__DIR__ . '/../blog.html'); exit; } // Basic allowlist for slugs to avoid path tricks. if (!preg_match('/^[a-z0-9-]{1,200}$/i', $slug)) { http_response_code(404); readfile(__DIR__ . '/../404.html'); exit; } readfile(__DIR__ . '/../blog-post.html'); exit;