[php] Index.php?section=xx&pag=yy - No MySQL or any other database

Alexandre Cisneiros

Feb 16 2006, 08:58 PM

Hi everybody. This is my 3rd script, but this dont use MySQL
It does this: divide the site in SECTIONS and PAGES.
Benefits:
-You have to create just the text of your pages, no create ech page with the entire layout again.
-If its just the text that is included, you just have to have one page with the layout, witch is the INDEX.PHP.
-If you chanche the layout in the index.php, you DONT HAVE TO change in the other pages.

Here is the code:

CODE

<?php
//-----------------------------------------//
//ACAF Paginação                           //
//by Alexandre Cisneiros                   //
//-----------------------------------------//

$section2=$_GET['section'];
$page2=$_GET['page'];

if(file_exists("$section2/$page2.php")){
include("$section2/$page2.php");
}

else if($section2 != '' && $page2 == ''){
    if(file_exists("$section2/index.php")){
    include("$section2/index.php");
    }

}

else if($section2 == "index"  || $section2 == "home" || $section2 == "default" || $section2 == ''){
include("main_page.php");
}

else{
echo ("404: The page was not found.");
}
?>

How to use:
If you want to have a page caled 'my_book.php' in the directory 'library', you can create a link like this:
http://www.yoursite.com/index.php?section=...ry&page=my_book
or just
http://www.yoursite.com/?section=libary&page=my_book

To crate a link to the index, you have 4 options:
http://www.yoursite.com/ ----JUST THE SITE ADRESS, WITH NOTHIS AFTER IT
http://www.yoursite.com/?section=index
http://www.yoursite.com/?section=main
http://www.yoursite.com/?section=deafult
This will load a page called PRINCIPAL.PHP (lower case)

To create a link to the INDEX.PHP (lower case) of some SECTION, do this:
http://www.yoursite.com/?section=my_section
This will include the index.php of the directory MY_SECTION (lower case, again,

)

---------REMEBER--------
-The files HAVE TO BE IN .php !
-The falis MUST

nightfox

Feb 17 2006, 12:43 AM

Nice! This is one script I'll have to save and play with!

I use a similar system except the site is controlled through a MySQL database to save file space.

Very nice!

[N]F

Hercco

Feb 24 2006, 04:20 PM

You shouldn't do this. And it should be obvious why.

You see, anyone can put anything in the URL, loading and executing any file with .php extension on the server. If you are on a shared hosting space some one could easily set up a malicious script to his own home directory and just use the section variable to navigate to right place and run the code. With your scipt...

To make things even worse, with PHP5. flle_exists works with URLs too. So with this script it is possible to load any script from anywhere inside your page.

And please don't forget that PHP can be used to run system commands, meaning that doing practiacally anything is possible. For instance it would be easy to delete your entire website.

So how this should be done then?

By allowing only pre-defined files to be included. You could put the allowed files (the PHP files that make up your website) in an array and use the array index in the URL GET variable to include the right page. For secions you could use multi-dimensional arrays or multiple arrays. Other option would be just use control structures like if() or switch() to load only specific pages: like this

CODE

switch($_GET['page'] )
{
   case index:
   include(index.php);
   break;

   case links:
   include(links.php);
   break;

// etc...
}

mastercomputers

Feb 25 2006, 12:36 AM

Unfortunately your code won't work correctly.

Here's a fixed up version with a few additional things to check for:

CODE

<?php
if(isset($_GET['page'])){
    $page = (!empty(trim($_GET['page'])))? trim($_GET['page']) : false;
    if(!page){ exit(); }
    switch($page){
        case 'news':
            include('news.php') or exit('<p>Sorry, the news page is missing.</p>');
            break;
        case 'contact':
            include('contact.php') or exit('<p>Sorry, the contact page is missing.</p>');
            break;
        default:
            include('main.php');
            break;
    }
}
?>

The changes for the fix, is that we're using the switch statement to check strings, which was incorrect with Hercco's code.

Also setting the $page variable uses the ternary operator ?: which acts as a single if/else statement. e.g. it could be written as:

CODE

if(!empty(trim($_GET['page'))){
$page = trim($_GET['page']);
}else{
$page = false;
}

The reason for exiting the script, is because there's really nothing to do, and loading the default isn't something that they may want. However if the page requested is not one of the listed, then the default will load the main content, because obviously the changes would have been made manually, and you should have hardcoded what you wanted specified.

Cheers,

MC

Alexandre Cisneiros

Mar 10 2006, 08:41 PM

Yeah. Iy`s true. I din't think about this...

So whith cases...

--==-=-=-=--=-
Sory for this...
But I`m a human xD

CrazyPensil

Mar 18 2006, 07:18 AM

You're showing off by this one that much as if you were the one who discovered it. I think, most of the people visitin' that topic use this one. And this is one of the biggest PHP's advantages.

P.S. Sorry, I was a bit rude to you, but I really dislike people showin' off for nothing.

Samya

Mar 21 2006, 04:05 PM

Hey nice work

Although I have not totally understoood the script, but I have copied it and I gonna play with it now ....

I hope that I will have no problems .....

If I came up with some problem, than I will mention here

Regards:
Samya Khalid

ADD REPLY / Got an Opinion!	a humble request :-)	RAPID SEARCH!	Free Hosting	[X]
Express your Opinions, Thoughts or Contribute more info. to help others. Ask your Doubts & Queries to get answers, So that "Together We can help others!"	Register FREE for AD-FREE forum, Create your own topics, Ask Questions, track topics, setup subscriptions & notifications and Get a Free Website w/ Email and FTP.		500MB Space No Ads, CPanel, FTP, PHP, MySQL, EMails - 100% FREE