phpInclude Help

[Luke]

Hello

Before I say: Yes i've googled it, AND been in tutorials section; i can get it to work, but not the way I wanted it to and/or it errors.

Right, what I want is to have index.php?page=blablahere BUT I want something like ?page=operations/staff or ?page=community/members and I'd want that to load *.net/pages/operations/staff.htm or php
If you get me?
Else it would display index.php?page=404 (pages/404.htm)

Anyone shed some light?
Cheers
Luke

[MattFr]

index.php?section=community&page=members
index.php?section=operations&page=staff

Then when including do the path like,

include "/pages/".$_GET['section']."/".$_GET['page'].".php"; 

All crap after the URL is bad anyway. Look into mod_rewrite.

[Luke]

Managed to get it all working - cheers

[Apolva]

index.php?section=community&page=members
index.php?section=operations&page=staff

Then when including do the path like,

include "/pages/".$_GET['section']."/".$_GET['page'].".php"; 

All crap after the URL is bad anyway. Look into mod_rewrite.

Make sure you verify the section/page against an array if you use this.

[Luke]

^^ Explain?

This is my code:

 <?php
                  if(!$_GET['page'] || $_GET['page'] == "home") {
                      include("pages/home.php");
                  }
                 elseif($_GET['page']) {
                      if($_GET['subpage']) {
                         if(!@file_exists("pages/{$_GET['page']}/{$_GET['subpage']}.php"))
                        {
                           echo "Not found.<br/><br/>The file could not be found - timmy must've ate it..";
                                                  
                        }
                        elseif(@file_exists("pages/{$_GET['page']}/{$_GET['subpage']}.php")) {
                            include("pages/{$_GET['page']}/{$_GET['subpage']}.php");
                        }
                                                                                          
                      } elseif(!$_GET['subpage']) {
                     /////
            if(!@file_exists("pages/{$_GET['page']}.php") || $_GET['page']==404)
                        {
                           echo "Not found.<br/><br/>The file could not be found, please use the navigation next time";
                                                  
                        }                elseif(@file_exists("pages/{$_GET['page']}.php")) {
                            include("pages/{$_GET['page']}.php");
                        }
                                                                                          
                      }
            }
                  ?>

[LMS16]

^^ Explain?

This is my code:

 <?php
                  if(!$_GET['page'] || $_GET['page'] == "home") {
                      include("pages/home.php");
                  }
                 elseif($_GET['page']) {
                      if($_GET['subpage']) {
                         if(!@file_exists("pages/{$_GET['page']}/{$_GET['subpage']}.php"))
                        {
                           echo "Not found.<br/><br/>The file could not be found - timmy must've ate it..";
                                                  
                        }
                        elseif(@file_exists("pages/{$_GET['page']}/{$_GET['subpage']}.php")) {
                            include("pages/{$_GET['page']}/{$_GET['subpage']}.php");
                        }
                                                                                          
                      } elseif(!$_GET['subpage']) {
                     /////
            if(!@file_exists("pages/{$_GET['page']}.php") || $_GET['page']==404)
                        {
                           echo "Not found.<br/><br/>The file could not be found, please use the navigation next time";
                                                  
                        }                elseif(@file_exists("pages/{$_GET['page']}.php")) {
                            include("pages/{$_GET['page']}.php");
                        }
                                                                                          
                      }
            }
                  ?>

I know the verify bit is important but if this is for a personal site then u obvs know the pages will exist...

Lew.

[Luke]

It isn't a personal site

[MattFr]

Basically that code would be pretty easy to exploit. This is pseudo because I can't be bothered to code, but do something like this:

switch section
case section 1:
switch page
case page 1, include page 1.
case page 2, include page 2.
default, show 404.
break
case section 2
switch page etc
break
default show 404.

Using this way, people can only get to pages you define. A better way to do this would be using a comparative array, but I cba to type that.

[Apolva]

One way to verify:

<?php
// Usage: ?p=section/page
// Doesn't check if page name matches section name, but this doesn't really matter.

// Separate section from page, and put into two variables.
list($section,$page)=explode("/",$_GET['p'],2);

// Set the allowed page/section names in the arrays below.
$allowedSectionNames=array("sectionname1","section2");
$allowedPageNames=array("home","about");

$file="pages/".$section."/".$page.".php";
$matchedSection=false;
$matchedPage=false;

// Cycle through the possibilities - check if section / page name is allowed.
foreach($allowedSectionNames as $name){
if($section==$name) $matchedSection=true;
}
foreach($allowedPageNames as $name){
if($page==$name) $matchedPage=true;
}

// If either the section or page name  is not allowed / doesn't exist, show four oh four.
if(!$matchedPage || !$matchedSection || !file_exists($file)) $file="page/404.php";

include($file);
?>

Haven't tested, but that should work + be secure.

But mod_rewrite is really more suited to this job.

[Agnostic Bear]

The code was secure enough as it was. It doesn't need changing.