Template security : To switch or not to switch?

[mhulse]

TITLE: Template security : To switch or not to switch?

Hi fellow PHP'ers!

I am using a switch/case statement on my main index/template page for tighter security (code snippet below)...

What would be a better alternative to the below switch statement? Can I write something more compact? I would like to avoid having to add every page to the statement... anyone out there have better techniques/alternatives? I would love to know of a more modular/compact way that also keeps security tight/tighter... I am planning on writing a photo gal that targets multiple variables on main template page (a possible example: somePage.php?pageHolder1=somePage&pageHolder2=anotherPage&pageHolder3=someImage, and using below code, I would have to add all if I want to get it to work... Ugh...:


<?php

if (!isset($_GET["display"])) {
$_GET["display"] = "home";
}

# Include the menu:
include($_SERVER['DOCUMENT_ROOT'].'/folio/inc/nav.inc.php');

# Figure out which page contents to display:
switch($_GET["display"]) {

// Home:
case "home":
include($_SERVER['DOCUMENT_ROOT']."/folio/gutz/home_gutz.php");
break;

// About:
case "about":
include($_SERVER['DOCUMENT_ROOT']."/folio/gutz/about_gutz.php");
break;

// Work:
case "work":
include($_SERVER['DOCUMENT_ROOT']."/folio/gutz/work_gutz.php");
break;

// Page default (404):
default:
include($_SERVER['DOCUMENT_ROOT']."/folio/gutz/error_gutz.php");
break;

} // End switch.

?>


Hopefully I am making sense... please help. :)

Thanks a billion peeps, I appreciate any help you could send my way.

Cheers
Micky

[tsinka]

Hi,

something like this might be easier:


<?php
$validPages = array("home","about","work");

if (isset($_GET["display"])) {
$page = $_GET["display"];
} else {
$page = "home";
}

// Include the menu:
include($_SERVER['DOCUMENT_ROOT'].'/folio/inc/nav.inc.php');

if (in_array($page,$validPages)) {
include $_SERVER['DOCUMENT_ROOT'].'/folio/gutz/'.$page.'_gutz.php';
} else {
include $_SERVER['DOCUMENT_ROOT'].'/folio/gutz/error_gutz.php';
}
?>


Just add any valid page to the array on top of the script and you're done.

Thomas

[mhulse]

Great! Thanks for the help tsinka! I really appreciate it!

Here is my adaptation to your code, let me know if you see anything funky... PHP security is something I am just now starting to concentrate on:


<?php

$valid_pages = array(); // Declare $validPages as array (Good practice).
$valid_pages = array('home', 'about', 'work'); // Put valid pages into array for inclusion.

if(isset($_GET['display'])) {
$page = $_GET['display'];
} else {
$page = 'home';
}

// Include the menu:
include($_SERVER['DOCUMENT_ROOT'].'/folio/inc/nav.inc.php');

if(eregi('^[a-z0-9\-_\.]+$', $page, $regs)) { // Make sure $page is alphanumeric.
$dir = 'gutz/'; //not strictly necessary, can be blank.
$name = '_gutz';
$ext = '.php'; //.php, .html, .txt, whatever

if(file_exists($dir.$page.$name.$ext)) {
if(in_array($page, $valid_pages)) {
include($_SERVER['DOCUMENT_ROOT'].'/folio/gutz/'.$page.'_gutz.php');
} else {
include($_SERVER['DOCUMENT_ROOT'].'/folio/gutz/error_gutz.php');
}
} else { echo '404 - Not Found'; } // Or something similar.
} else { echo 'Naughty Naughty, very Naughty.'; }

?>