General PHP Structure Questions

[influx]

Hey all,

Since I taught myself PHP and don't have much sophisticated knowledge about coding in it, I was wondering if I could ask a few questions to get more familiar with universal methods of coding.

I run a website service with various features, including uploading files, analyzing page statistics, posting message, etc. The way I have structured the website is as follows:

members/upload
members/stats
members/posting

Is the lack of obscurity a problem to begin with? In each directory I have a home page (upload.php, stats.php, posting.php) and I have a 'test' file to actually run code when they submit the form (upload_test.php, stats_test.php, posting_test.php). In each 'test' file I have various different functions I can execute. For example, in the posting_test.php, function 1 will remove a post, function 2 will add a post, function 3 will remove all posts, etc.

So, when somebody submits a certain form on posting_test.php, here is what the form action tag looks like: <form action="posting_test.php?code=1" method="post"> (for example, this is for removing a post).

So my posting_test.php file is separated into codes (code1 remove post, code2 add post, code3 remove all posts), propagated through the URL (is this a big mistake?) and I simply post the respective code under if($code==1){<<CODE HERE>>} if($code==2){<<CODE HERE>>} etc.

Is there a problem with the way I have this set up?

Thanks!
-influx

[leatherback]

Hi,

in principle there is no problem with the structure and folders. Just make sure there is a default index.php / index.html in the folder, and/or make sure no index can be retrieved otherwise. This to avoid people browsing through the folder.

If you have files which should be included, and you need a login for that, make sure you test whether it was actually included (e.g.: Set a variable in the main page, and test whether it is set to a valid value, before processing the included file)

Passing variables through the url in itself is not a problem. Again: Make sure that what you get in the script, is valid input. If you define your actions by numbers: Test that they are numbers, and within range. Otherwise: Test agains scripts etc.

J.

[influx]

So I should change all the index pages to index.php? When I link to them, could I link to the directory? i.e: <a href="members/upload/">upload files</a> or do I need to <a href="members/upload/index.php">upload files</a>? I have never understood that completely, doesn't it depend on the server? Or is it always alright to link to just the folder?

Thanks!

[topsub]

i didn't read everything in this post, but i read ur last post and if inside the directory you have an "index.php" You can just like to that directory

[leatherback]

MOST (!) servers are setup in a way that when you link to the folder, it will look for either index.htm, html, php/ I found that my provider uses all three, in that order.

So you can link either to the script, or to the directory, when you use inddex. html/html/php

J.

[influx]

Would it be sufficient enough to just check and see if the $code in the 'test' files is either number 1, 2, or 3?

something like:

if($code != 1 || $code != 2 || $code != 3)
{
    die();
}

Also, on every member page I have a small script to check and see if they are logged in and I have the following code on those pages:

if ($logged_in == 0) //check if user is logged in, if not don't allow access to rest of page
{
	echo 'Sorry, either your session has expired or you are not logged in. You may, however, return to the <a href="http://www.website.com">websitehome page</a> and log in or register for a free account from there.';
	include($path_prefix.'universal/footer_simple.php');
	exit;
}

I should also include this little tidbit of code on the 'test' files too, right? As of now I don't but I just realized that could be very problematic..

[leatherback]

You could just do something like:

switch($code)
  {
case 1:
// do things for $code = 1 here
break;

case 2:
// do things for $code = 2 here
break;

}

In your includes, I'd place a require(..) statement, referring to a file which does something like::

<?php

// This script tests whether the called file is called through the correct domain 
// If this is not the case, we move the page to otherwebsite.

$headertest = $_SERVER['REQUEST_URI'];
$pos = strpos($headertest, "mydomain.com");

if(($pos === false) or ($myvar <> 'MyPreDeFinedVar'))
   {
   header("Location: http://www.somewhere.com/"); /* Redirect browser */
   exit();
   }

?>

[influx]

Oh, easy enough, thanks!

Now, one last question. What if I am not using a form and have a link like: <a href="post_test.php?code=2>Remove this post</a>

Is there any way I can propagate this using $POST instead of $GET?

-influx

[leatherback]

hehe,

GET is through the URL, so technically no. You coudl use a javascript onclick=submit() I supopse.. I don't, and I am not sure about the details..

J.

[influx]

But wouldn't you agree that that is a better approach?

[leatherback]

No.
Then you depend on a client-side solution. And why would you care that they know what is passed? Anybody trying to hack can look at the source of your page, and see all the passed vars anyway.

J.