A few problems exist with the above (albeit, nice of the posters to try and help :tu: ):
CreedFeed said:
Code:
<?
$id = $_GET['id'];
switch ($id) {
case '1':
echo "This is content for id 1";
return;
case '2':
echo "This is content for id 2";
return;
default:
echo "You have specified an invalid page.";
return;
}
?>
Every time this page is accessed, all of it has to be proccessed by PHP on the server. This could become a very long page indeed and the server-load will kill you :o
Zymic's solution is screwy at best, becuase it is divided into two parts that contradict each others variables, and the first would error anyway. The first part contains, for example:
switch ($HTTP_GET_VARS[id]) {
//Default - case
default:
include "news/news.php";
break;
//Fonts - case
case 'resources=fonts':
include 'resources/fonts.php';
break;
...............................................>>>
How can you check for "id=resources=fonts" ? Atleast without encoding the URL, you can't :gl:
The second problem here, and this applies to all of these solutions: Every time you add a new page, you have to go alter the index.php page to check for the variable. Double work, plus makes for more code your server has to proccess every time index.php is loaded.
The best of the solutions given so far, is that of
hairyfreak ( :kickass: ). It allows you to add additional pages later, without ever having to alter the index.php again
However, for the sake of security, I am going to upgrade
hairyfreak's solution a notch (no offense
hairyfreak ):
------------------------------------
In index.php:
PHP:
<?
define("CodeWord", "VerySecretPassword");
$id = $_GET["id"];
if($id == "" || !file_exists("/path/to/your/site/SECRETFOLDER/$id.php")) { $id = "home"; }
include ("/path/to/your/site/SECRETFOLDER/$id.php");
?>
In each new page, add this:
PHP:
<?
if (CodeWord == "VerySecretPassword") {
..............content goes here..............
}else{
die("You can not access this page directly!");}
?>
The above solves two security issues. #1) Assume your index.php is located at
/path/to/your/site/index.php , then by putting all of your "called" pages in some obscurely named secret folder (in my example:
/path/to/your/site/SECRETFOLDER/... ), you keep folks from just being able to access them directly by looking at the variable. Say you had
http://site.com/?index.php=home , they could just try and see if
http://site.com/home.php itself existed. This can be bad, if you don't want your pages called without being inside your index.php page. For some uses, this can even be dangerous. By having them in a secret folder, you complicate the issue for them trying to access the pages directly. #2) Basically, secures pages from being called by themselves (rather you use a hidden folder or not). It is that "define" function, and the part you add to each page. This tells your index.php to make a constant named "CodeWord", and give it the value of "VerySecretPassword" (be creative and make a hard to guess value). Once the called-pages are called, they check to verify that infact "CodeWord" exists, and that it has the correct value. If not, no-see-this-page-for-you-buddy
. If the called pages are accessed without being called from index.php, they get same message, becuase the "CodeWord" constant is not properly defined
Another, and even more secure tip: Put the called pages under your root-directory. That way, calling them via URL direclty in browser doesn't work anyway.
Hence, with combining these, you have: 1) Hidden the pages, preventing them from being accessed directly. 2) Further enhanced #1, by making them non-functioning, even if they have the direct URL for them. 3) Saved yourself from having to add to or change the index.php page every time you add new pages. 4) Made it, as
hairyfreak so nicely did it, so that if the called page doesn't exist, they get shown a default "home.php" instead.
Hope this didn't confuse the issue, and that it helps :blink: Now, for some true PHP guru like
SecondVersion to come and show me the error of my ways :lol:
