jigga wrote:Alright lots of good info from everyone
Yeah, you got alot of good comments. I certainly recommend jonlinks php.ini settings to tighten your site up:
# set register globals off
php_value register_globals 0
set allow_url_fopen off
php_value allow_url_fopen 0
set magic_quotes_gpc off
php_value magic_quotes_gpc 0
set magic_quotes_runtime off
php_value magic_quotes_runtime 0
And yes, as someone mentioned, sometimes, of course, you need to set variables externally. As that person mentioned, you must at that point, filter the users input (make sure they send what is expected.) For example, in http://www.google.com/search?q=cross+site+scripting, google will want to make sure that a remote user cannot insert SQL code to be executed at the Database server (this is all hypothetical of course as Google probably has various layers that queries pass through.) In PHP, for example, something like http://www.google.com/search?q=;+DROP *; (maybe not a legitimate example, but should give you the idea that somebody might be able to modify your data for malicious purposes) could be really bad. So you'd want (again the example is hypothetical) to use a jonlinks validate function in this case.
As for your question, the way to take variables out of the include statement (dynamic paths) would either be just linking to individual pages or using GET variables to toggle content. Since the former is self-explanatory, I'll explain the latter only.
I have used a similar switch statement in the past to run various content output functions:
<?php
switch ($_GET['mode']) {
case "users":
showusers();
break;
case "delete":
showdeleteusers();
break;
default:
showsearch();
}
function showusers()
{
//do something
}
function showdeleteusers()
{
//do something
}
function showsearch()
{
//do something
}
?>
As you see, all of my functions are in-line in the very same script.
Now, for follow-up, since changes like this may be very abrupt, you should be safe with the code I gave you, or even the example of a bunch of if elseif statements previously demonstrated by a responder here. Someone mentioned using file_exists(), which is a good idea as I don't believe it works on external (remote) files. You can throw that into the mix.
As always, good luck.
. You should be able to turn off allow_url_fopen in the php.ini file you found, that should take care of things. or you can put the following into your .htaccess file: