URL explanation

unlucky17

Hello all. First time poster, here. I already know HTML, CSS and have a basic understanding of PHP but I need some specifics as I'm trying to build a PHP site from scratch and am running into a few roadblocks.

So, I've looked everywhere to see how PHP parses everything beyond the ? in the URL and haven't found any useful documentation. Is there some kind of code I could put on an index.php file to point it to specific SQL records (by ID, perhaps)? How does it work?

I've looked up some documentation that gives details on how to generate URLs by using arrays but what I'm wanting to do is having a shell of a site (basically a static table where every page uses the same outline, and stems off the index.php file), then some kind of code to insert an "article" (preferrably a SQL record) in a cell of a table and can't find any documention on how to do that. I've used PHPwCMS and Joomla who both do that exact thing but scrounged the code and can't figure out what would govern everything beyond the ? in the URL, unless I am just thinking too much and it relies on whatever database you specify and pulls records by ID or whatever other field is in the URL..?

Keep in mind that I'm new to the language and relatively new to programming in all. Thanks for any help. 🙂

dagon

if url is

http://www.site.com/index.php?type=red

then the php var to get red is

$_GET['type']

unlucky17

dagon;10908084 wrote:
if url is

http://www.site.com/index.php?type=red

then the php var to get red is

$_GET['type']

Ahh, I see. I found the answer in another thread concerning this same thing. Sorry for my extreme level of incomprehension!

I found the code of:

<?php 
if (isset($_GET['page'])) { 
    include($_GET['page'] . '.php'); 
} 
else { 
    include('404.php'); 
} 
?>

And it all makes sense, but they mentioned something about it being an insecure method. What's the objective of using an array instead of just this code?

dagon

its insecure because some one could access files you didn't expect them to by guessing their file name

bradgrafelman

There's a couple alternatives to that method of dynamically including scripts;

Put all of the .php scripts that you will dynamically include into one folder. Then, you can check if the filename passed in the URL contains a '/' or a '\' that would alter the path. If not, it'd be a simple include("path/to/folder/$_GET[page].php") for example.

Make an array of allowed choices, and check that the variable matches one of those values:

$pages = array('main', 'faq', 'contact', 'sales', 'etc');
$id = (isset($_GET['id']) ? $_GET['id'] : FALSE);

if($id !== FALSE) {
    if(in_array($id, $pages))
        include "$id.php";
    else
        die('Invalid page specified!');
}