What you think is this method is good to make website

Discussion in 'HTML & Website Design' started by astrohope, Mar 30, 2010.

  1. #1
    I make 1 website using this method , the website have 3 column , Left_body.php, right_body.php, body_center.php and header.php and footer.php i make them individual , then i make 1 file name index.php, and use this method to add all in index
    <?php include ("body_center.php");?>

    in body_center.php i call all the other html page links with this method

    else if ($_GET['id'] == "articles"){
    include ("centerbody/articles.html");
    }
    else if ($_GET['id'] == "sharfa_shames"){
    include ("centerbody/articals/sharfa_shames.html");}

    i have so many page and links and i dont want to make mess i use this method because when i add any new page i just make that html page in centerbody and include and make link in just body_center.php file ,

    What you think is this method is good to make website ? eny one else using this ?
     
    astrohope, Mar 30, 2010 IP
  2. s_ruben

    s_ruben Active Member

    Messages:
    735
    Likes Received:
    26
    Best Answers:
    1
    Trophy Points:
    78
    #2
    You can try this method:

    
    if (isset($_GET['id']) && file_exists("centerbody/".$_GET['id'].".html")){
        include "centerbody/".$_GET['id'].".html";
    }
    
    Code (markup):
     
    s_ruben, Mar 30, 2010 IP
  3. deathshadow

    deathshadow Acclaimed Member

    Messages:
    9,732
    Likes Received:
    1,999
    Best Answers:
    253
    Trophy Points:
    515
    #3
    Don't forget to NEVER include a un-sanitized user input - so you'd want to strip out "../" from the $_GET, and possibly use something like urlencode on it... and probably take the time to do a file_exists as well.

    
    $page=urlencode(str_replace("..//",'',$_GET['id']));
    $targetPage='centerbody/'.$page.'.html';
    if (file_exists($targetPage)) {
    	require_once($targetPage);
    }
    
    Code (markup):
    Which is kind-of how my home-brew CMS handles it - though it has all output wrapped in functions so that if you call any of the sub-files directly, they don't output anything... Security man, security.

    Well, that and I parse $_SERVER['REQUEST_URI'] instead of using $_GET so that I can also use the same function with a mod_rewrite for 'friendly' URL's.
     
    deathshadow, Mar 30, 2010 IP