Basic PHP for Content Management? How Did I Do?

austingecko

I recently completed a project only using PHP and include files (no database).

Essentially each topic has its own directory (like '/cars') and within each directory are include files (like '/cars/ford.inc') with the pages' main content in really basic html.

The site is really using on one page ('index.php') and content is called in the url (like 'index.php?topic=cars&page=honda'). The index page builds a page and adds the appropriate file (like '/cars/honda.inc') to the header, footer of the page, and other relevant sections.

This method was used instead of using a database or OSS content management app because one of the company's requirements was that updates/modifications could only be done in files, transferred with ftp. So, OSS CMS apps with user/password required for updates/modifications would have been too much.

Non-technical company employees wanting to update/modify information on the Web site then only have to update or modify basic html files in Dreamweaver while the index page handles formatting and page buiding --- no access to a database is required.

This approach is probably very novice-like. But, would like to hear some feedback.
Any comments or suggestions?

cgraz

I think you did a good job; especially since it works! I've done sites in this similar manner (and still do). It works great when people need to do the updating, and you don't want them messing with the real code. That way if they mess anything up, it doesn't effect the overall site.

Cgraz

feldon23

austinecko said:
( vBCode makes me sad --- Simple HTML should be allowed. It is as easy to understand as vB Code and is more universal. Popular community blogs use HTML, why not at a popular PHP site? )

Because every 5 minutes there's another vulnerability or some other wierdness with HTML that can expose users and or a forum to being hacked/infected with a virus/etc.

You can extend bbCode on your own forum you know.

Plex

I am interested in how you have done this. What website is this used on? I have PHP access on my site, but no databases to use, so if you could teach me how to do this or write a small tutorial, I'd be very happy to give you credit for helping me with the coding. I am starting a news website for a small anime community that I am in and I write alot of articles and reviews on websites, if I could do something like what you are talking about, it would make alot of things easier. Please let me know, thanks.

martyn

Basicly it would have been an include:

include("/$topic/$page.inc")

So a URL of www.url.com?topic=cars&page=honda would goto /cars/honda.inc (it starts off local from the script, so the path is relative to the script path.)

Hummmm, that sounds a bit confusing 😉

martyn

I suppose it should be like this though:

include("/$POST['topic']/$POST['page'].inc")

There you are feldon23 just for you 😉

pakman

I suppose it should be like this though:

include("/$POST['topic']/$POST['page'].inc")

I hope not, what if I pass a fake form with the value of "topic" set to http://mysite.com/evil-php and "page" set to "mailmeallpasswords.php".

You should never trust any input from the browser, always check it. I understand however that most of the php nuke clones have this error in them so you are not the only person to make it 🙂

martyn

Well then, check to see if either of the values are empty, then only allow them to goto certain folders 😉

austingecko

so the include would be something like

include ($definedpath . "/$POST['topic']/$POST['page'].inc");

This way http://mysite.com/evil-php would return an error because the include would look for http://www.mysite.com/definedpath/http://mysite.com/evil-php

... and not http://mysite.com/evil-php.

Generally, index.php builds the pages with content from minimal .inc pages (which are specified).

Another way to handle security is to have the URL specifying the topic and page != the actual path or name of an .inc file. For example, index.php may pull content for index.php?topic=cars&page=honda from 22/12.inc (22 could be a directory and associated with 'cars' and 12 could be the .inc file associated with honda). By using this method, user input/URL is not used for including a file but just to determine which file is to be used. And the actually path of the include file is never revealed to the user. The URL becomes more for user friendliness, 'this is what you are looking at.'

Come to think of it, using a number system with folders and files for content management could help with organization and content inventory (see http://www.adaptivepath.com/publications/essays/archives/000040.php ).

shire

austingecko,

I am thinking of implementing the same thing as you describe in the beginning of this thread.

How does this system perform when one would be expecting 25-30k per day in traffic?

If anyone could give me an insight on how this would affect apache I would be most appreciative.

austingecko

Codewalkers has scripts set-up like discussed:
http://codewalkers.com/code.php?c=3

Some examples are Easy Content Management:
http://codewalkers.com/seecode/104.html

and

Phrozen
http://codewalkers.com/seecode/180.html

I'm still looking for other examples... If anyone else has some, or comments, it would be interesting to hear them.

shire, content management of the type discussed is pretty simple php stuff (mostly includes are used) - so, I guess it depends on what resources are available for php and what caching is used.