I'm working on a site in php. Originally I had a lot of html pages but they were all very similar in that they had a heading, an image, and some text. I was able to consolidate my pages into one php page and pass in the heading and image name as GET variables. I wouldn't want to pass a lot of text this way though. What's the best way to do this? I was thinking of including the text from a text file but then I'd have a text file for every item. I also thought that I could have a database and read the text from there. What do you guys think?
A:
pass in the heading and image name as GET variables
This is probably not secure. And its a bad coding practice to rely on GET's for your page structure. Why not use includes?
As for storing the data, the database is the way to go, flat files suck.
So, you could pass a unique ID for the text, and always include your header and footer:
include_once('header.php');
//If the id is valid, use it to query the text from the database.
include_once('footer.php');
babonk
2010-07-29 04:12:47
Why are GETs bad? I've seen tons of actual websites that pass variables in the header. The information isn't sensitive so security shouldn't be an issue. If I use includes, don't I have more flat files anyway?
JPC
2010-07-29 04:16:08
It's not that GETs are bad (they're great!), it's that there's no logical reason to pass the header and footer on every page. You would want to pass id's for the image and text (then lookup the relevant content from your database)
babonk
2010-07-29 04:17:57
Also, it's often insecure to take filenames directly from GET, because hackers can possibly exploit this by putting files that aren't supposed to be there in the query string.
babonk
2010-07-29 04:20:12
+1
A:
According to me, it is better you use the database and just pass the ID's, through the $_GET.
You can divide your page in three sections.
header.php // including all the header section
body.php // your main content, varying according the $_GET
footer.php // footer section
Thanks.
Chetan sharma
2010-07-29 04:14:43
A:
You're right, using GET variables is inconvenient. It is also very insecure, since an attacker could trick a user into following a link which would inject HTML into the page, which could then pass the user's cookies to the attacker.
The most common approach is to store the various content blocks in a database such as MySQL. See the PHP MySQL docs to get started. You can then set up a simple form or WYSIWYG editor such as TinyMCE to allow the site administrator to edit content.
Mark Eirich
2010-07-29 04:20:41