Hello there.
How wonderful to see these forums! I really hope you'll be able to help me please.
Basically, what I'm trying to achieve is the following.
The below code is my "contact.php" which is loaded via page.php (hence the stuff at the top), so it's actually page.php?p=contact.
I have the staff information in /home/LAN/public_html/staffinfo/ which is 1.html through to 11.html.
Basically, I want it so that if say, page.php?p=contact&id=4 is loaded, 4.html will loaded. I have an old way of doing this that works, but I believe what i'm trying is more secure. I also want it so that only files from within that directory can be loaded.
Here's what I've so far, it doesn't work but I'm hoping you guys will easily see what i've done wrong and what I need to do, I am pretty new so my apologies.
The NON working code:
<?php
if (!strpos($_SERVER['PHP_SELF'], "page.php")) {
die ("Sorry, You cannot access this file directly...");
}
$index = 0;
include("header.php");
$allowed = array('1' => '1.html','2' => '2.html','3' => '3.html','4' => '4.html','5' => '5.html','6' => '6.html','7' => '7.html','8' => '8.html','9' => '9.html','10' => '10.html','11' => '11.html');
if (empty($_GET['id'])) {
include $allowed['/home/LAN/public_html/staffinfo/1.html'];
} else {
if (in_array($_GET['id'], $allowed)) {
include('/home/LAN/public_html/staffinfo/' . $allowed[$_GET['id']]);
} else {
echo 'Sorry, that staff ID does not exist. Please try again.';
exit;
}
}
?>
<div align="center">
The staff list here.
<br /></div>
<?php
include("footer.php");
?>
My old way of doing this:
<?php
if (!strpos($_SERVER['PHP_SELF'], "page.php")) {
die ("Sorry, You cannot access this file directly...");
}
$index = 0;
include("header.php");
if (is_numeric($_GET['id'])) {
$id = $_GET['id'];
$info = "/home/LAN/public_html/staffinfo/$id.html";
if (file_exists($info)) {
include ($info);
} else {
echo "Sorry, that staff ID does not exist. Please try again.";
}
}
else {
?>
<div align="center">
The staff list here.
<br /></div>
<?php
}
include("footer.php");
?>
Thank you very much in advance. 🙂
