giving 404 if file doesn't exist

[goatee]

Hi,
the way my site works I have the outside bit which stays the same across the site, and then the section is given in the query string, and then the content is in a file included (from a path added to the default path, using ini_set)

What I want to do is check if there is a query string, and if there is, check that the file exists, and if it doesn't give a 404.

My code atm looks like

$query = $_SERVER['QUERY_STRING'];
if ($query && (!file_exists("$query.php")))
{
       header("Status: 404 Not Found");
}

but this does not work. Any ideas?

I've also tried using isset and is_null on both $query and $_SERVER['QUERY_STRING'].

Thanks

Goatee

[seby]

$query = $_SERVER['QUERY_STRING']; 
if ($query && (!file_exists("$query.php"))) 
{ 
       header('HTTP/1.0 404 Not Found');
       exit;
}

i never see anyone do something like that with query_string... but anyway, you might need the full path to the file in the function.

[goatee]

I know I should do some 'taint' checking on it, but since I only include it, if the file exists, I thought that would serve both purposes.

I just taught myself php by starting converting the site from basic XSSIs, and then as I wanted to know how to do something, googled for the answer. If you can suggest a neater way of passing the section name - I'd be more than happy to take suggestions.

Cheers

Goatee

[goatee]

ok, for some unknown reason,

This works,

header("Location: [url]http://www.goatee.org/index.php?error[/url]");

but these don't

header("Status: 404 Not Found");
header("HTTP/1.0 404 Not Found");

I'm not at my wits end - why is this not working?

Thanks

goatee

[seby]

dont use the header(Status..

use just header('HTTP/1.0 404 Not Found');

It works, i use it all the time.
create a php file with nothing in it except:

<?php
header('HTTP/1.0 404 Not Found'); 
?>

.. and try.

[goatee]

thanks for that - the oddest thing though - if I do it on an empty page it works, if I have this code though, it doesn't! 🙁

<?php
        $query = $_SERVER['QUERY_STRING'];
        if ($query && (!file_exists ("$query.php")))
        {
                header('HTTP/1.0 404 Not Found');
        }
. . . 

though header("Location: http://www.goatee.org/index.php?error"); does work.

I'm completely baffled - what could I be doing wrong?