More bullet proof websites

Anon

I have 2 questions that I hope will make my site a little stronger.

I have created a basic layout for my site with a variable set to change the content. ( include $content.php ) Pages are refreshed throught the URL with something like this: www.mysite.com/info.php?content=page1

This works great as long as the links are followed but is it possible to write an if statment that will check to see if the variable is set first or if even page1.php exists. The problem I see is if somebody changes the URL to info.php?content=about they are going to get errors saying the file can't be found or opened.

I have a database table with 50 records, each with an email field. Can I have a form that when I fill it out and click send it will send it to each member until the last row is sent? Something like Until EOF. My goal is to create a newsletter that is sent to each member as an individual email and not done in bulk.

From there I plan on adding a check box in the admin pages so they can cancel the newsletter but I assume thats as easy as if checked send, else skip record.

Thanks

Anon

For Question 1:
Here is some code I use when doing something similar to what you are doing:

// This will make sure that they didn't try to change the directory!!!
if($content)
str_replace("/","",$content);

// If we do not have a page, load a default page
if(!$content) {
include("default.php");
// Otherwise we have a page to load...
} else {
// Make sure the page exists
if(file_exists("$content.php"))
// Then include it!
include("$content.php");
else
// Otherwise load a 404 style page
include("404_notfound.php");
}

Hope this helps...

-Josh

Anon

Too bad it won't keep my tabs in there properly 🙁

mithril

Regarding your first question, you can create an array of valid content template values:

  $templates = array("page1", "page2", "page3"....);

Then use a conditional statement to load the default if the passed content value isb't valid:

  if (!in_array($content,$templates))
    include("default.php");
  else
    include($content.".php");

Regarding your second question, a simple loop should do it:

<?php

  $headers = "From: you@yourdomain.com\nReply-To: you@yourdomain.com";
  $body = "This is a test email";
  $subject = "This is a test email";

  $conn = @mysql_connect("host", "user", "pass");
  @mysql_select_db("db_name", $conn);

  $rs = mysql_query("SELECT email FROM user_table", $conn);

  while ($row = @mysql_fetch_array($rs, MYSQL_ASSOC)) {

    if (eregi("^{[a-z0-9-]+(.[a-z0-9-]+)@[a-z0-9-]+(.[a-z0-9-]+)$",$row["email"]))}
      @mail($row["email"], $subject, $body, $headers);
  }

  @mysql_close($conn);

This should get you started, HTH.

-geoff

Anon

I think it would probably be better to put everyone in the to, cc, or bcc line altogether and mail it out once.

$nIndex = 0;

while($row=mysql_fetch_array($result)) {

if($nIndex > 0) $mail_to .= ",";
$mail_to .= $row["email"];

}

(This assumes that you have already validated the email addresses before they went into the database.)

@mail($mail_to, $subject, $body, $headers);

Probably doesn't make much difference except the database is saved some wear and tear and the mailer daemon gets it all at once to dispatch 50 messages instead of 50 times to dispatch one message each time.

Just my opinion.

If you start mailing alot and you are leasing web space somewhere, it would probably be a good thing to make sure your web presence provider knows what you are doing so they don't tag you as a spammer and shut you down.

Jim

Anon

for more info on this,

http://www.php.net/manual/en/function.mail.php

Anon

I have thought about that and actually already tried it that way. That would be fine but some users don't like that and would prefer to have the emails more personalized. Plus some mail accounts like hotmail block emails that have multiple entries in the to box.

This is not spam since it is registered users and they have the ability to turn of the newletter. There is 50 emails in the database and this will never go up or down.

About alot of wear and tear, I plan on sending one email a month maybe so its not really that bad.

Thanks for all the replies adn the if else statment for the include statment works perfect.