I don't know if you are still working on this project or not, but I thought of this post when I was working on one of my own. I think I have come up with a safe method of addressing pages as per the simpler but unsecure method I mentioned before.
If anybody sees a problem with this, comments are MORE than welcome, but I think it is secure and certainly much easier than adding all those pages by hand.
I didn't want to go back and change all my existing links, so I wrote it so it would add a .php exension on the links. It might be able to drop into your application by making it do the existing switch, but future links you might be able to bring in on the GET safely using their own path
(i.e. ?page=articles/a/article1.txt)
<?php
// gather the $page variable
// however it might be arriving
if (isset($_POST['page'])) {
$page=$_POST['page'];
} elseif (isset($HTTP_POST_VARS['page'])) {
$page=$HTTP_POST_VARS['page'];
} elseif (isset($_GET['page'])) {
$page=$_GET['page'];
} elseif (isset($HTTP_GET_VARS['page'])) {
$page=$HTTP_GET_VARS['page'];
} else $page="menu.inc.php";
// assign all the extensions that might be included
$extension=array(".php",".htm",".html",".txt");
if (in_array (strrchr($page,"."), $extension) ) {
// make sure page is in local directory path
$include="./".$page;
} else {
// adding '.php' worked for my needs
//$include="./".$page.".php"; // attach extension
// putting the switch here might work for you
switch ($page) {
case 'article1':
$include= 'articles/a/article1.txt';
break;
case 'article2':
$include= 'articles/b/article2.txt';
break;
default:
$include= 'menu.inc.php';
}
}
// display the page
?>
<html><head><title>Template</title></head>
<body>
<?php if(!@include("$include")){include("./menu.inc.php");}?>
</body>
</html>