[RESOLVED] MOD rewrite

[chrisguk]

I currently have a rewrite solution setup on my site but as I am adding more and more pages the directory is becoming a little complicated. My setup is below for illustration:

index.php

<?php
$page = isset($_GET['p']) ? $_GET['p'] : 'main';

switch($page) {

case 'contact': 
$title = 'foo';
$keyword = 'bar';
$description = 'foobar'; 
$stylesheet = '../style.css'; break;

include($_SERVER['DOCUMENT_ROOT'].'/include/header.php');
include($_SERVER['DOCUMENT_ROOT'].'/host/'.$page.'.php');
include($_SERVER['DOCUMENT_ROOT'].'/include/rightnav.php');
include($_SERVER['DOCUMENT_ROOT'].'/include/footer.php'); 
?>

.htaccess

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^host/([\w]+) /index.php?p=$1 [L]

So at the moment all my content files are in a directory called "content".

My question is how can I split the files up into different directories using the same mod_rewrite technique if you get my meaning.

[sneakyimp]

If someone requests /host/foo/bar then your index.php file should feed "foo/bar" into $page, right? That would result in including /host/foo/bar.php. Could you not then just put some file named bar.php in directory /host/foo?

For what it's worth, your code might present a security risk. What if someone requests /host/../../some_secret_file.txt ? Your code doesn't appear to check for that contingency.

EDIT: corrected mistake in first para.

[sneakyimp]

Ahh wait. I see that your mod_rewrite rules insist that the request cannot refer to a file or directory. I think that solves the security risk I had in mind. I'd still be a bit wary about including a file whose name is more or less directly derived from user input.

[chrisguk]

sneakyimp;10940749 wrote:

If someone requests /host/foo/bar then your index.php file should feed "foo/bar" into $page, right? That would result in including /host/foo/bar.php. Could you not then just put some file named bar.php in directory /host/foo?

For what it's worth, your code might present a security risk. What if someone requests /host/../../some_secret_file.txt ? Your code doesn't appear to check for that contingency.

EDIT: corrected mistake in first para.

First of all sorry about the double post I forgot about the first post.

Thank you for the reply.

If I didnt need or have the rewrite rule of course this would never be a problem I guess. I have been told there is a way of changing my .htaccess content to state that index.php can call files from any directory level or something similar.

Honestly, im really not sure where to go with this one and how to resolve it I have researched to the death and cant work out the answer.

If you maybe wanna add me to msn i could talk about it in more depth perhaps.