views:

52

answers:

4

Hello,

I want to control the access in php website.

I have a solution right now with switch case.

<?php
      $obj = $_GET['obj'];
      switch ($obj)
        {
      case a:
         include ('a.php');
         break;

      default:
         include ('f.php');
 }
?>

But when i have so many pages, it becomes difficult to manage them. Do you have better solutions?

Right now, i develop the application using php4. And i want to use php5. Do you have any suggestions when i develop it using php5?

Thanks

A: 

I am not saying that this is the best solution, but years ago I used to have a website which used a database to manage the key, the page to be included, and some informations like additional css for instance.

So the code was something like:

<?php

  $page = htmlspecialchars($_GET['page']);
  $stuffs = $db->query('select include,css from pages where pageid = "' . $page . '" LIMIT 1');

?>

So when we needed to add a page, we just created a new field in the database. That let us close a part of the website too: we could have a "available = {0,1}" field, and if zero, display a static page saying that this page was under maintenance.

Aif
what htmlspecialchars does here?
Col. Shrapnel
I forgot ENT_QUOTE which escapes the ' and " and other special chars. It avoids risks for sql injection (no ') and if xss if i print $page.
Aif
htmlspecialchars has nothing to do with sql. it is **html** specialchars, not sqlspecialchars. the proper function is mysql_real_escape_string()
Col. Shrapnel
I know that. But ENT_QUOTE turns ' in ' so ?Moreover, be it only for the xss stuff, I do ALWAYS escape the user input. I don't see the matter.Is that why I got -1?
Aif
not only quote character must be escaped and not only user input should be properly prepared for the query
Col. Shrapnel
`htmlspecial` chars doesn't stop SQL injection.
Lotus Notes
+2  A: 
$obj = $_GET['obj']; 

$validArray = array('a','b','c','d','e');

if (in_array($obj,$validArray)) {
   include ($obj.'.php'); 
} else {
   include ('f.php');
} 
Mark Baker
It's better than using switch. Thanks!
garcon1986
A: 

why not just address a page itself?

<a href="a.php">first page</a>
<a href="f.php">another page</a>
Col. Shrapnel
in this way, the users can see all the files as they typed in the URL.
garcon1986
@garcon1986 what's wrong with it?
Col. Shrapnel
@garcon1986: And what is the difference with having `/index.php?obj=a`, `/index.php?obj=b`, etc.? I can type that too.
Felix Kling
yes, users can type any thing in the url. But code like this <a href="f.php">another page</a>, is not easy to manage.
garcon1986
if there are so many links, it would be terrible.
garcon1986
@garcon1986 no, there wouldn't be so many links. Only a few. Say, you have single script news.php and all news pages would be shown by this single script. How many sections your site would have?
Col. Shrapnel
+1  A: 

The more pages you have the harder it will be to control this.

Your best off using a framework of some sort, my personal preference is CodeIgniter.

fire
codeigniter will be a good solution?
garcon1986
yes indeed, its very easy to use and has loads of libraries that help you write code much quicker
fire