QUOTE(Yacoby @ Sep 25 2006, 11:32 AM)
what you don't do is say why this method is better than just making totally separate pages?
Yacoby, using the php query string is only one way to manage a php based site. Typically, there is only one "page" and the "content" for the page is altered based on the value of the query string.
Using this method to simply accept the value as input by the user, as Spectre points out, can be very dangerous. Imagine if they inserted the name of a file which contains all of your database passwords and usernames? Maybe even your cpanel name and password, etc... not that you would keep that information inside your account files, right?
Click on the link in my siggy to review a template (not the zip file) which I have used a similar, but "more secure" method. What I do in my Template is check the query string value (what comes after the question mark) and evaluate it against the contents of an array which includes a list of the 'acceptable values'. If the query string is in the array, the page is displayed, otherwise, the index page is viewed.
CODE
Menu Array
<?php
$data_array = array('index', 'one', 'two', 'three', 'four', 'five', 'contact');
?>
Source Code
<?php
$submit = $_GET[page];
if( !isset($_GET[page]) ) {
if (file_exists($data_array[0] . '.txt' )) {
include ( $data_array[0] . '.txt' );
}
else {
include ('index.txt');
}
}
elseif (in_array($submit , $data_array)) {
if (file_exists($submit . '.txt' )) {
include ( $submit . '.txt' );
}
else {
include ('index.txt');
}
}
else {
if (file_exists($data_array[0] . '.txt' )) {
include ( $data_array[0] . '.txt' );
}
else {
include ('index.txt');
}
}
?>
Admittedly, this is not an ideal solution. I should probably 'sanitize' the input string, too, but it has never (yet) caused me any grief.
Review the template by clicking the link in my sig and if you wish to download the zip file, by all means, do so.
Reply
