Problem with passing variables

Shibby

Ok...

I'm having a problem where I cannot read the variable properly when an url like this is used:
index.php?Page=Cheats

The page I am using to get the data is this:

<?php

$PageTitle = "Kule Place =]";

require ("../include/header.php"); //(header sets the PageTitle)
require ("img/logo.php");

//even if I take the following if conditional out it still doesn't make any difference:
if (!$Page) {
	$Page = "news";
}

$ThisPage = $Page . ".php";

if (file_exists($ThisPage)) {

require ($ThisPage);

} else {

print("<b>$ThisPage could not be found.<br>Please go back to the main page by clicking <big><a href=\"index.php\">here</a></big>.</b>");

}

require ("../include/footer.php");

?>

The problem I am having is that it just defaults to news.php with any Page in the address. Even if I take out If (!$Page) {... then I just get ThisPage could not be found...

I'm running Windows 98SE, Apache 2.0 and PHP 4.2.3

steved

Not sure how your system is configured, but a sure way to set your variable from the URL would be to add this at the top of your script.

$Page = $_GET["Page"];

I'd put it right after you set the $PageTitle variable.

devinemke

your script will fail if register_globals = "OFF"
you should do:
$ThisPage = $_GET['Page'] . ".php";

BTW: it is very bad security practice to include/require files based on user input. what if i typed the follwing into my browser:

http://www.shibby.com/index.php?Page=/path/to/evil/script

your script (assuming the file existed) would do the following:

require ('/path/to/evil/script.php');

this is a simple example that may not be easily exploited but you get the general idea.

Shibby

Oh yes, I didn't consider that 🙂

But what would the alternative be?

(oh and thanks for the help)

saidbakr

If you do this script for practice or locally on your machine, you may modify inside php.ini file, commonly located in windows directory, the following value
register_globals=off
to
register_globals=on😃

devinemke

what i usually do is store all of the allowable page_id's in an array and use the in_array() function to validate that it is one of my files and not /path/to/evil/script

Shibby

OK... thanks 🙂

I got it to work well