little code help / question

[The_broken]

ok, I been working a template system.

My index.php has this

<?php
require 'pages/template.html';
$path = 'pages/';
$extension = '.html';

if ( preg_match("#^{[a-z0-9_]+$#i",$page)} ){
$filename = $path.$page.$extension;
include($filename);
}
?>

The script above call the master page template.html which works fine.

It also works great when I hard core the links i.e. ?page=about

Now in the center of the template I left open for content. What I am trying to do is call the content by links using a PHP call tag.

If the index.php page is call I want it to load the main.html content, but if a person select a diffrent link " ?page=about" I would like it to replace the main.html file with the about.html

I tried this which did not work.

<?
// error_reporting(0);
if(!$file=fopen("$page.html", "r")) {
//error_reporting(E_ALL ^ E_NOTICE);
echo "Sorry, the page you tried to access could not be found on the server";
} else {

   include("$page.html");
        }

?>

I thought it would work, but I am wrong... 🙁

Can anybody help me with the php tag needed for the template page so that it calls the main.html when index.php is called but will switch when another link is called....

Also there is no DB being used, it just calls another html file from a folder named pages.

sincerely,
Robert

[Weedpacket]

Well, the first part of your problem may be that answered by Question One of the Newbie's FAQ (and try setting your error reporting to E_ALL).

But your real problem is conceptual: you're trusting the user not to give you a bogus or malicious value for the "page", even allowing them to ask for any file on your server.

Never give them the opportunity. You can't stop them sending you anything they like, but you don't have to (and certainly shouldn't) unwittingly serve them anything they ask for without checking that it is something they're allowed to ask for.

Keep a list of files they're allowed to ask for (build it on the fly by reading through the pages directory if you want), and only serve them the page they ask for if it's on that list. Give them something else if it isn't.

[The_broken]

I don't understand what you just said.... remember I am still learning here.

I am trying to build/write a php tag or function to control which html files get call by the link.

On the template.html the tag should call main.html template if the index.php is called always, but if a link is selected it should call the requested html page.

( ie - domain.com/index.php would call main.html from page folder ) but

(ie - if domain.com/index.php?page=about is called it will call the about template)

thats what I am trying to figure out... how to write the php tag required in the template page that controls the template functions.

thanks