PHP website design / Computer Science / Forums

Welcome

Online

Members Birthdays:

All today's birthdays', congrats!
Ian (36)
Lucas (39)

Next birthdays
01/31 Mathias (41)
01/31 slash128v6 (52)
02/01 Barry (70)

Contact

Support 4hv.org!

Donate:
4hv.org is hosted on a dedicated server. Unfortunately, this server costs and we rely on the help of site members to keep 4hv.org running. Please consider donating. We will place your name on the thanks list and you'll be helping to keep 4hv.org alive and free for everyone. Members whose names appear in red bold have donated recently. Green bold denotes those who have recently donated to keep the server carbon neutral.
Special Thanks To:

Aaron Holmes
Aaron Wheeler
Adam Horden
Alan Scrimgeour
Andre
Andrew Haynes
Anonymous000
asabase
Austin Weil
barney
Barry
Bert Hickman
Bill Kukowski
Blitzorn
Brandon Paradelas
Bruce Bowling
BubeeMike
Byong Park
Cesiumsponge
Chris F.
Chris Hooper
Corey Worthington
Derek Woodroffe
Dalus
Dan Strother
Daniel Davis
Daniel Uhrenholt
datasheetarchive
Dave Billington
Dave Marshall
David F.
Dennis Rogers
drelectrix
Dr. John Gudenas
Dr. Spark
E.TexasTesla
eastvoltresearch
Eirik Taylor
Erik Dyakov
Erlend^SE
Finn Hammer
Firebug24k
GalliumMan
Gary Peterson
George Slade
GhostNull
Gordon Mcknight
Graham Armitage
Grant
GreySoul
Henry H
IamSmooth
In memory of Leo Powning
Jacob Cash
James Howells
James Pawson
Jeff Greenfield
Jeff Thomas
Jesse Frost
Jim Mitchell
jlr134
Joe Mastroianni
John Forcina
John Oberg
John Willcutt
Jon Newcomb
klugesmith
Leslie Wright
Lutz Hoffman
Mads Barnkob
Martin King
Mats Karlsson
Matt Gibson
Matthew Guidry
mbd
Michael D'Angelo
Mikkel
mileswaldron
mister_rf
Neil Foster
Nick de Smith
Nick Soroka
nicklenorp
Nik
Norman Stanley
Patrick Coleman
Paul Brodie
Paul Jordan
Paul Montgomery
Ped
Peter Krogen
Peter Terren
PhilGood
Richard Feldman
Robert Bush
Royce Bailey
Scott Fusare
Scott Newman
smiffy
Stella
Steven Busic
Steve Conner
Steve Jones
Steve Ward
Sulaiman
Thomas Coyle
Thomas A. Wallace
Thomas W
Timo
Torch
Ulf Jonsson
vasil
Vaxian
vladi mazzilli
wastehl
Weston
William Kim
William N.
William Stehl
Wesley Venis

The aforementioned have contributed financially to the continuing triumph of 4hv.org. They are deserving of my most heartfelt thanks.

Forums

4hv.org :: Forums :: Computer Science

« Previous topic | Next topic »

PHP website design

previous 1 2 3

Move Thread

LAN_403

Simon

Wed Oct 24 2007, 01:27AM

Registered Member #32 Joined: Sat Feb 04 2006, 08:58AM
Location: Australia
Posts: 549

Uzzors wrote ...

Your simple fix prevents that from happening too, c4r0, I think I'm going to have to rename my files and employ it. Who knows what else might turn up!

That's the right kind of attitude. When people point out issues like that, they're really saying, "Your site is abusable enough for this to happen," instead of, "Here's a specific bug to fix," which is what many people read it as, unfortunately.

First off, I'll say I'd do what Matt suggested (far less breakable), but if I were to go along with how you're doing things, I'd have the code strip all non-alphanumeric characters from the input before using it. (It's some time since I've coded PHP but there should be a command similar to AWK's gsub.) Then I'd have the code check against a limited list of allowed pages to load. (An associative array could do this nicely.)

A fundamental security commandment is, "Thou shalt not execute user input." Doing an include on a user inputed string is equivalent to executing arbitrary user input. (This is one reason why I'd prefer Matt's method.) Putting the input through an associative array means only internally generated strings are executed.

krenshala

Sat Jan 05 2008, 02:00AM

Registered Member #143 Joined: Sat Feb 11 2006, 04:25PM
Location: Austin TX, NorAm, Sol III
Posts: 28

I know its been a while since anyone posted to this thread, but since I did my website in PHP I thought I'd share some helpful info.

First of all, you guys might want to use require_once() instead of include() to add files to the page. This way, you only include a particular file one time, even if you call it specifically more than once accidentally (e.g., one particular article).

For testing to see if a particular file is there, use file_exists() in an if statement. I did this for the site I made for my son. Index.php includes a "body" file. Page0.php is the default "main" page, and the pages increment from there. I use numbered pages because I wrote a "prev -- main -- next" auto-link function for it so you can go to any page from main, or go to the next/prev page from the page you are currently on. It checks to see if next page exists, and if it doesn't then "next" is not a link (i got tired of changing the max page count variable every time my wife added a new page ;).

<?php
/* pre-header and header code */

/* variables */
$path = "/var/www/localhost/htdocs";

$page = $_GET['page'];
if( !is_numeric( $page ) ) $page = 0;
/* database */
---  snippage of db calls and doctype/head content ---
<body>
  <div class='title'>k i e r o n ' s   s i t e</div>
<?php require_once( $path . "/menu.php" ); ?>
  <div class='main-page'>
<?php
  $p = $page - 1;
  $n = $page + 1;
  $main = "main"; $prev = "prev"; $next = "next";
  if( $page != 0 )
    $main = "<a href='/kieron.php?page=0'>main</a>";
  if( $page > 1 )
    $prev = "<a href='/kieron.php?page=$p'>prev</a>";
  if( file_exists( "$path/kieron/page$n.php" ) )
    $next = "<a href='/kieron.php?page=$n'>next</a>";
  echo "    <div class='menu-pick'><img src='/img/prev.png' /> $prev "
     . "â€” $main â€” $next <img src='/img/next.png' /></div>\n";
  require_once( "$path/kieron/page$page.php" );
  echo "    <div class='menu-pick'><img src='/img/prev.png' /> $prev "
     . "â€” $main â€” $next <img src='/img/next.png' /></div>\n";
?>
  </div>
<?php require_once( "$path/foot.php" ); ?>
</body>
</html>

hmmm ... this editor is adding ; before all the < symbols in the code instead of converting them to <.

I set $path to the full filepath for the site at the top to keep the require_once() function calls short enough for one line. menu- and foot.php are both static files used on every page, while pageN.php (where N is the number) are the pages only used for this particular site.

I'm using style sheets (CSS2.1) to do the layout (title at top, menu on the right, main body left of the menu). Check out the Position is Everything website for some good tips.

Oh, and I use vim (CLI text editor) on my linux box (I run my own server) and vim for windows on the XP gaming machine. ;)

previous 1 2 3

Moderator(s): Chris Russell, Noelle, Alex, Tesladownunder, Dave Marshall, Dave Billington, Bjørn, Steve Conner, Wolfram, Kizmo, Mads Barnkob

Legal Information