Trouble with URL variable and IF/ELSE statements

seancotter

I have a relatively large site. Its entirely in done in XHTML and CSS and have used php as the technology base but have stuck with just using php for includes for now.

I have a page like so (news/default.php)

<?php include("mainwrapstart.inc"); ?>
<?php include("header.inc"); ?>
<?php include("navigation.inc"); ?>
<?php include("contentstart.inc"); ?>

<?php include ("$_GET[inc]"); ?>

<?php include("right.inc"); ?>
<?php include("contentstop.inc"); ?>
<?php include("footer.inc"); ?>
<?php include("mainwrapstop.inc"); ?>

The seperated out line is the trouble child.
I got as far as being able to pass a variable:

(news/default.php?inc=currentnews.inc)

And the page renders fine. If there is no URL variable the page errors out. In the same directory I have news1.inc, news2.inc, news3.inc, currentnews.inc, etc.

I want to make a statement that will allow /news or /news/default.php to render fine and use the currentnews.inc include as default if there isn't a URL variable being passed through.

My goal (which probably seems obvious 🙂) is to be able to have a list of links on the right that replaces the currentnews.inc when selected by the user:

default.php?inc=news1
default.php?inc=news2
default.php?inc=news3
default.php?inc=news4
etc.

I know its probably simple... and I have googled my brains out trying to find something similiar that I could adapt and understand but to no avail. Until I hardcoded this new site in XHTML/CSS my experience was mostly with Dreamweaver and simple VB/ASP apps made with the built in Macromedia generators.

I would appreciate any guidance. Feel free to email me.
Regards,
sean
www.iel.spokane.edu

niroshan

If I undestood your question right, Accroding to the $inc value you are trying to include files right? 😕

Well here is an example for you but in my example i havent include any file instead i used functions. So if you undestood the logic i`m sure you can use this as a guide line and build your own application.

<html>
<head>
<title> new document </title>
</head>
<body>

<?php

function news1()
{
	print "News article 1";
}

function news2()
{
	print "News article 2";
}
function newsDefault()
{
	print "Default News article";
}

if(isset($_GET['inc']))
{
	if($_GET['inc']=="")
	{
		newsDefault();
	}
	else
	{
		$item=$_GET['inc'];

	switch ($item)
	{
		case 'news1':
			news1();
			break;

		case 'news2':
			news2();
			break;

		default:
			newsDefault();
			break;
	}
}
}
else
{
	newsDefault();
}	
?> 
<br/><br/>
<a href="test.php?inc=news1">News 1</a>
<br/>
<a href="test.php?inc=news2">News 2</a>


</body>
</html>

Hope this is what you want.

Good luck.

Regards,
Niroshan

seancotter

Yes, I am just looking to pull an include into the appropriate spot in a page.

I am still too new I guess to change what you gave me to adapt it to what I need.

I think it should be pretty straightforward... I believe anyway 😃.

<?php include ("$_GET[inc]"); ?>

I am looking for the "$_GET[inc]" to be replaced with "currentnews.inc" by default and something else if its provided by the URL variable.

I think the part below is saying that if the GET is null then newsDefault() goes in place of the 'inc'?

if($_GET['inc']=="")
{ 
        newsDefault(); 
    }

Megahertza

This is a shorter version of niroshan code which I rip and just made smaller, instead of using functions i used includes only. This code will include currentnews.inc when ?inc=currentnews.inc is passed or when nothing is passed or when anything apart then above and the other news articles. When ?inc=news1.inc is passed then that news item will be shown. To add another news article just add another

            case 'news2.inc': <-  Just change what is going to be passed.
            include 'news2.inc'; <- What you want to be included.
            break;

if(isset($_GET['inc']))
{
    if($_GET['inc']=="")
    {
        include 'currentnews.inc';
    }
    else
    {
        $item=$_GET['inc'];

    switch ($item)
    {
        case 'news1.inc':
            include 'news1.inc';
            break;

        case 'news2.inc':
            include 'news2.inc';
            break;

        case 'news3.inc':
            include 'news3.inc';
            break;

        default:
            include 'currentnews.inc';
            break;
    }
}
}
else
{
    newsDefault();
}    

?>

gammaster

Hi!
This is a possible solution:

$legalIncludes = array(
                     'news1.inc',
                     'news2.inc'
                     );

if(isset($_GET['inc']) && in_array($_GET['inc'], $legalIncludes))
   include($_GET['inc']);
else
   include('default.inc');

justsomeone

Yes gammaseter!

The $legalIncludes check is absolutely vital. Without it you're inviting anyone to view any file on your system

seancotter

gammaster wrote:

Hi!
This is a possible solution:

$legalIncludes = array(
                     'news1.inc',
                     'news2.inc'
                     );

if(isset($_GET['inc']) && in_array($_GET['inc'], $legalIncludes))
   include($_GET['inc']);
else
   include('default.inc');

This is still along the lines where I will need to define what's allowed and what isn't? Meaning the code is going to get longer and longer as I add allowed 'news' to the archive.

One thing that I can't get my head around exactly is this:
yes, this is for includes, but very well could be for a bit of text, date, whatever... the fact that it's in include is arbiturary isn't it? All I want, verbatim, is the text 'currentnews.inc' put into the page at this point

<?php include ("$_GET[TEXTTEXTTEXT]"); ?>

by default unless GET is something else from the URL.

And no, I really don't have any programming experience...lol 😃

gammaster

Hi!
There is an important thing about this: YOU HAVE TO KNOW WHAT YOU ARE INCLUDING

Let say the url www.domain.com?inc=../myPasswordFile.php

If you includs whatever things could be real bad. Do you se why?

In a list of best practise in secure PHP programming this is number one. 🙂

Cent

Going with the recommendations so far, I would throw in a file_exists() check just to make sure the file actually exists. though would you really want people to know the names of your include files? perhaps just using the first part of the file name (left of the extension) and append the extension within your include call.

best,
cent

gammaster

Hi!
I have to comment Cent.

If you do a file exists check it is worthless if you don`t have a collection of legal include files to check against.


// If this file realy exists a check don`t change anything.
$_GET['inc'] = '../myPasswordFile.php';

if(file_exists($_GET['inc']))
   include($_GET['inc']);

If you drop the extension in $GET['inc'] nothing is changed:

$_GET['inc'] = 'someDir/anotherUnlegalIncludeFile';

$file = $_GET['inc'].'.inc';

if(file_exists($file))
   include($file);

The point is that you need to have something to check against and not the whole file system. This could be done in several ways, in a switch block as descibed in this thread, against an array with legal file names as descibed in this thread or maybe a directory as described in the next example.

A solution for a dynamic pool of news files could be this:

$_GET['inc'] = 'someNewsFile';

$pattern = '/^[a-zA-Z0-9]+$/';
$newsDir = 'myNewsDir';
$default = $newsDir.'/default.inc';

if(
   !isset($_GET['inc']) ||
   !preg_match($pattern, $_GET['inc']) ||
   !file_exists($newsDir.'/'.$_GET['inc'].'.inc')
   )
   include($defaultNewsFile);
else
   include($newsDir.'/'.$_GET['inc'].'.inc');

seancotter

I think by not limiting the pool of files we are opening ourselves up (I was able to traverse the file system some using the file:/// syntax in place of the file.inc). Also, at the minimum I should be hiding the .inc extension in the URL parameter... that just makes sense.

I am still working on the news section and this problem is the same as it was, but I am also working on a googlemaps mashup (of sorts).

www.iel.spokane.edu/locations/default.php

Gammaster,

I looked at your last suggestion and think that's what I want to do. I was able to change the syntax some to match the situation, and the chosen default map include shows up each time, but referencing another include still brings up the default, obviously I missed something. If I give you a description of the setup do you think that you could change your previously posted code to fit my setup?

It's laid out like this:

default.php contains all the code and references to the includes
/maps/ contains all the actual includes

The default include should be lodge.inc
the others would be timbukto.inc, vandownbytheriver.inc, etc

I like the idea of hiding the actual .inc extension in the URL, that just makes sense so a URL would be:

default.php?location=lodge

I made some changes to what was posted, but like I said something is missing.

Actually, I think my confusion is in the first line, and where that is referenced.

<?php include("googlekey.inc"); ?>
<?php $_GET['location'] = 'lodge'; 

$pattern = '/^[a-zA-Z0-9]+$/'; 
$mapsDir = 'maps'; 
$default = $mapsDir.'/lodge'; 

if( 
   !isset($_GET['location']) || 
   !preg_match($pattern, $_GET['location']) || 
   !file_exists($mapsDir.'/'.$_GET['location'].'.inc') 
   ) 
   include($defaultMap); 
else 
   include($mapsDir.'/'.$_GET['location'].'.inc'); ?>

If anyone is interested, the includes for the maps are in the head of the page and contain some javascript edited to show the correct long/latitude with the pop-up bubble containing pictures, address info, links, etc. The googlekey is specific to the domain, so to keep it portable I included it as a seperate include.

You can do this with XML and all that... but usually those are multiple locations on the same map... I just want a close up view for each site with driving instructions, etc. Our locations are pretty fixed 😃 so I think getting the geocode info and making a custom location.inc for each won't be that big of a deal. I just want to have the one page and be able to reference through the URL the locale. 😉

Thanks for the ideas everyone...