[PHP] Includes.

[Lilian]

Hey,

I have just done a website with php includes so far so good but 1 problem.

?page=comments?id=$b[id] 

That link wont work. I know its the ?id=$b[id] but how could I go about fixing it?

Thanks

[Ini]

Hey,

I have just done a website with php includes so far so good but 1 problem.

?page=comments?id=$b[id] 

That link wont work. I know its the ?id=$b[id] but how could I go about fixing it?

Thanks

change

?page=comments?id=$b[id] 

to

?page=comments&id=$b[id] 

[Lilian]

Thanks +Rep

[Ini]

No problem im here to help.

Well sort of... ;l

[Blob]

And you can just keep adding aswell

?view=hello&me=is&not=gay&so=lets&go=to&bed=please

[Invent]

Make sure the includes script has protection, this is a good example of a secure including script:

<?php

if( isset ( $_GET[ "page" ] ) && !empty( $_GET[ "page" ] )) {
    
    $page = $_GET[ "page" ];
    $page = str_replace( ".", "", $page);
    $page = urlencode( $page );
    $page = htmlentities( $page );
    $page = "". $page .".php";

    if( file_exists( $page ) ) {
    
        include( "$page" );
    
    }
    else {
    
        include( "404.php" );
    
    }
}

?>

[Lilian]

Make sure the includes script has protection, this is a good example of a secure including script:

<?php

if( isset ( $_GET[ "page" ] ) && !empty( $_GET[ "page" ] )) {
    
    $page = $_GET[ "page" ];
    $page = str_replace( ".", "", $page);
    $page = urlencode( $page );
    $page = htmlentities( $page );
    $page = "". $page .".php";

    if( file_exists( $page ) ) {
    
        include( "$page" );
    
    }
    else {
    
        include( "404.php" );
    
    }
}

?>

Yer thanks ive already got that

[Invent]

:p I got bored, so I decided to make it lol.

[Mentor]

Make sure the includes script has protection, this is a good example of a secure including script:

<?php

if( isset ( $_GET[ "page" ] ) && !empty( $_GET[ "page" ] )) {
    
    $page = $_GET[ "page" ];
    $page = str_replace( ".", "", $page);
    $page = urlencode( $page );
    $page = htmlentities( $page );
    $page = "". $page .".php";

    if( file_exists( $page ) ) {
    
        include( "$page" );
    
    }
    else {
    
        include( "404.php" );
    
    }
}

?>

A good alternative i find is just to keep the files in a dir and hardcode it to the script which prevents any misuse

$page = $_GET[ "page" ];
$location = "pagesfolder/".$page.".php"; 
    if( file_exists($location) ) {
        include($location);
    }else {
         include( "defultpage.php" );
    } 

put what u like in the url, pagesfolder/http://haxzorsite.hax/l33t.php.php aint gona be found.

ps. -removed- i was wrong, im to use to js escapting

[Invent]

Yes, but I thought incase for some odd reason they may want to protect files from another folder being accessed.

Because with your script the user could do ?page=../../page.php

Not sure why you need to block it but yeah