13 replies to this topic

[cigraphics]

I've made my own navigation system:

<?php
if($id == NULL) {
include('home.php');
} else {
include(''.$id.'.php');
} 
?>

let's break the code a little:

if($id == NULL)

If the $ID has no ?id=test or something it will include the home.php file

include('home.php');

else it will include the ?id=download and the file will be download.php

include(''.$id.'.php');

[NinJA999]

First, you would have to do

$id=$_GET['id'];

to use the id variable.
Then, you could use this code to actually go to the pages rather than including them.

<?php
$id=$_GET['id'];
if($id == NULL) {
header("Location: home.php");
} else {
$theplace=$id+".php";
header("Location: $theplace");
}
?>

[Matthew.]

Don't bother with using IF statements for navigation,

Simple use switch for something simple.

[rus321]

switch($_GET['id']) {

case 'home':
include("index.php");
break;

default:
include("404.php");
}

Edited by rus321, 03 July 2006 - 06:34 PM.

[cigraphics]

i know to do it with switch statement but i prefered to make my own

[Indigo]

Before including files, you could also check if the file exists:

<?php (file_exists(file.php)) ? include "file.php" : include "error.php"; ?>

To check if the id is a number, use something like is_numeric (don't remeber the exact name, but it might be something like that).

[Hit3k]

<?php
if($id == NULL) {
include('home.php');
} else {
include(''.$id.'.php');
}
?>

That could be used for XSS (Cross Site Scripting) exploit
eg
you could set the id to be http://somesitehere....liciouscode.php
and I'd also recommend the switch function

[Hayden]

one thing i thought of when doing include statements to to help further define WHERE that file is.

define("ABSPATH", $_SERVER['DOCUMENT_ROOT']);

then you can do

include(ABSPATH.$id.".php")

and somebody can't exploit your script to view files below the root.


add that with Indigo's post and you've got it made.

[Ziggy]

what would you do if you want to include a default 404 page?

[Chris.]

if(!file_exists(''.$id.'php')
{
	 include("404.php");
}
else
{
	 include(''.$id.'php');
}

[Ziggy]

thanks

[nitr0x]

The problem with using a switch function is that it's very time and space consuming. Plus when you add a new page, you have to add a new block of code again.

[CB Productions]

rus321, on Jul 4 2006, 09:33 AM, said:

switch($_GET['id']) {
 
 case 'home':
 include("index.php");
 break;
 
 default:
 include("404.php");
 }

You still need an IF to check if $_GET['id'] is set.
if($_GET['id']) {
$id = $_GET['id'];
switch($id) {

...

}
}

and switch isn't very useful if your site adds quite a lot of pages quite often.

[Hayden]

SpatialVisionary, on Jul 13 2006, 10:22 PM, said:

one thing i thought of when doing include statements to to help further define WHERE that file is.

define("ABSPATH", $_SERVER['DOCUMENT_ROOT']);

then you can do

include(ABSPATH.$id.".php")

and somebody can't exploit your script to view files below the root.


add that with Indigo's post and you've got it made.

One minor change I would make to this, lol it's my own post.

define('ABSPATH', dirname(__FILE__));

Do that in your main index.php, btw.