Could you please check this?

camperz0

Hi- I have doen something. This is what I have got:

I have my layout right? Its all done. There is a links area, and a content area. They are both blank.

In the content area I have this:

<?php include ("$id"); ?>

In the links area i ahve a link like this:

http://www.host.com/main.php?page=content.txt

So when the link is clicked it will load up that page which is just a simple txt file into the content area. I was wondering can I include html in the txt so it will dysplay or will this not work?

Secondly wat do i do so that the main page loads up when people go to my domain? thanx

Weedpacket

(0) Try it and see.

(1) It will work and HTML will be rendered - assuming you use $_GET['id'] instead of "$id" and that the file really is there.

(2) if $_GET['id'] is empty, assume the main page is wanted and include that instead.

(3) This is a very bad security hole.

camperz0

ok i c but dont understand lol how is is a big security flaw? secondly is there somewhere i can go to get a free script because i dont think this is my thing lol

leatherback

Hi,

It is a big security hole because if you use this method, there is nothing you can do if somebody decides to link:

http://www.host.com/main.php?page=www.MyPage.com/MaliciousScript.txt

You should consider using:
http://www.host.com/main.php?page=20

and in your script:

$id = $_GET['id']

if($id) = 20
{
$page = "index.txt";
}

or (If you have an array with all the page names in it):

include($pages[$_GET['id']]);

camperz0

lol i c know! jesus neone could like put pron in or sumin lol! thanx for the help i really appreciate it!

camperz0

sry to bother u guys again but could u post the code for an array like u said? i dont know how to do one...

Weedpacket

u cd do it lk ths-*&#!@NO CARRIER%%#%$-0--. Sorry.

You could do it like this:

$valid_pages = array('content', 'main', 'morecontent', 'othercontent', 'discontent', 'datcontent');
if(in_array($_GET['page'], $valid_pages))
{
    include $_GET['page'].'.php';
}
else
{
   include 'main.php';
}