looking for simple code....

shinoshi

to embed multiple pages into 1 index.php
to which changing the page like "index.php?news" would bring up the news page

eg.

if ?news

html for news page goes here

if ?contact

html for contact page goes here

please help me, i found code that did this a long time ago, can't find it anywhere now can contact me via IM-- AIM: "JedonGor" Yahoo:"jedon_gor" MSN: "shinoshiyamazaki@hotmail.com" Icq: "107591948" might say i am offline, but i am usually invis/away mode

bradgrafelman

Well, here's a quick example of how I would recommend doing it:

$valid = array('news', 'contact', 'foo', 'bar');

if(in_array($_SERVER['QUERY_STRING']), $valid)
	readfile($_SERVER['QUERY_STRING'] . '.html'); // e.g. news.html
else
	readfile('index.html'); // what to do if query was blank or invalid

In other words, you would define an array of valid choices - that way people couldn't use your script to access files you didn't expect them to (e.g. "../../some_script.php").

scrupul0us

thats not completely safe brad:

...
On some platforms, an attacker can supply NULL in the URL to terminate the string. For example:

http://example.org/index.php?username=../etc/passwd%00
This effectively eliminates the .html restriction.
...

best practice to use a basename in there:

EXAMPLE:

    <?php

$clean = array();

if (basename($_GET['filename'] == $_GET['filename'])
{
  $clean['filename'] = $_GET['filename'];
}

include "/path/to/{$clean['filename']}";

?>

...Chris Shiflett

laserlight

This effectively eliminates the .html restriction.

However, it does not circumvent the check with the array of valid names.

Chris Shiflett's approach works for arbitrarily including a file in a given directory, but the method that bradgrafelman outlined is equally safe, but less arbitrary since it uses a pre-defined list.

scrupul0us

its best not to assume that the people that are being helped here will do exactly as shown... it never hurts to err on the side of caution esp. when it comes to security...

otherwise i agree with you

laserlight

its best not to assume that the people that are being helped here will do exactly as shown... it never hurts to err on the side of caution esp. when it comes to security...

Well, bradgrafelman explained the idea (the file extension thing was merely in passing in the code example itself), but you did not explain Shiflett's idea*, and you have coding errors in your example as well, so I hope that no one uses your example exactly as shown :p

For completeness, Shiflett's idea is to check that the filename supplied by the user is merely a file name without a path (the base name), thus restricting the file name to the given directory. Instead of checking, one could just assign the base name to the variable used for inclusion. Either way, it would be a good idea to check that the file exists before including it.

shinoshi

can i use more than 1 if statement in the same array, such as

ifesle

how would that work into the array?

laserlight

What do you mean?

shinoshi

<?php

// which pages could be loaded
$valid = array('news', 'home', 'forum);

$page = $_SERVER['QUERY_STRING'];

if(in_array($page, $valid))
{?>
 <body bgcolor="000000" text="FFFFFF">
<table border="0" width="1200" height="50" celspacing="0" cellpadding="0">
<tr>
<td valign=middle align=center celspacing="0" cellpadding="0"><a href="index.php?home"><img src="/images/header.gif" alt="HEADER" height="50" width="1200" border="0"></a></td>
</tr>
</table>
<table border="0" width="1200" height="100%" valign=top>

<tr>
<td width="100" align=left valign=top celspacing="0" cellpadding="0"> <? include 'menu.html'; ?> </td>
<td align=left valign=top celspacing="0" cellpadding="0"><? include("inc/$page.inc"); ?></td>

</tr>
</table>
</body>
<? include 'footer.html' ;

}
ifelse (in_array($page='forum, $valid))
{

?>
<title>Jedon dot Net - forum</title>
<body bgcolor="000000" text="FFFFFF">
<table border="0" width="1200" height="50" celspacing="0" cellpadding="0">
<tr>
<td valign=middle align=center celspacing="0" cellpadding="0"><a href="index.php?home"><img src="/images/header.gif" alt="HEADER" height="50" width="1200" border="0"></a></td>
</tr>
</table>
<table border="0" width="1200" height="100%" valign=top>

<tr>
<td width="100" align=left valign=top celspacing="0" cellpadding="0"> <? include 'menu.html'; ?> </td>
<td align=left valign=top celspacing="0" cellpadding="0"><iframe src="forum/" height="100%" width="1100"><iframe></td>

</tr>
</table>
<? include 'footer.html'; ?>
</body>

<?
}
else
{

include('inc/default.inc');

}
##elseif (in_array('forum', $valid))
##<? include("inc/$page.inc");
;
?>

this is my script so far but there is a problem with the ifelse

laserlight

The syntax is if, else and elseif, but at best only if and else are required here. The "ifelse (in_array($page='forum, $valid))" and its corresponding block does not make sense.

shinoshi

k i got rid of that section its now

<?php

// which pages could be loaded
$valid = array('news', 'home', 'zomg');

$page = $_SERVER['QUERY_STRING'];

if (in_array($page, $valid))
{?>
<body bgcolor="000000" text="FFFFFF">
<table border="0" width="1200" height="50" celspacing="0" cellpadding="0">
<tr>
<td valign=middle align=center celspacing="0" cellpadding="0"><a href="index.php?home"><img src="/images/header.gif" alt="HEADER" height="50" width="1200" border="0"></a></td>
</tr>
</table>
<table border="0" width="1200" height="100%" valign=top>

<tr>
<td width="100" align=left valign=top celspacing="0" cellpadding="0"> <? include("menu.html"); ?> </td>
<td align=left valign=top celspacing="0" cellpadding="0"> <? include("inc/$page.inc"); ?> </td>

</tr>
</table>
<? include 'footer.html'; ?>
</body>

<? }
else

{ ?>
<body bgcolor="000000" text="FFFFFF">
<table border="0" width="1200" height="50" celspacing="0" cellpadding="0">
<tr>
<td valign=middle align=center celspacing="0" cellpadding="0"><a href="index.php?home"><img src="/images/header.gif" alt="HEADER" height="50" width="1200" border="0"></a></td>
</tr>
</table>
<table border="0" width="1200" height="100%" valign=top>

<tr>
<td width="100" align=left valign=top celspacing="0" cellpadding="0"> <? include 'menu.html'; ?> </td>
<td align=left valign=top celspacing="0" cellpadding="0"><iframe src="forum/" height="100%" width="1100"><iframe></td>

</tr>
</table>
<? include 'footer.html'; ?>
</body>

<?

}
##$_get['page'];

<? include("inc/$page.inc");

?>

which works, but not exactly the way i had thought shrug

http://jedon.net
(not complete)