Some Newbie PHP Questions

[gson.bizhat.net]

1. Right now I'm taking advantage of the include function of PHP so I can increase the robustness of my site navigation (I tend to have a brainstorm half way through every now and then) and I really don't like the usage of Frames.

I noticed it was getting really tedious making a Switch/Case for every page I had (E.g index.php?action=contacts needed to have a

case 'contacts': include ('contacts.php')...

statement) Since I'm naming the file to be included the same as the action (contacts in my previous example), could I declare a single variable to accomplish the same thing?

<? if (isset($_GET['action'])) $PAGE = $_GET['action']; 
include ($page+'.php');
?>

Because right now I have a ridiculous amount of statements (150 or so) for every page of my site, and I figured there were some tricks I was missing.

2. Also, does the page I'm including have to have a .php extention? Or could it be HTML or even TXT?

3. Is it usually better to name the action variable to be more descriptive or more simple? (E.g. index.php?action=affiliates vs. index.php?action=affs)

4. Can the action variable be renamed to anything I want? I notice some sites using just act.

Thanks for your time.

[triax]

1. yes you can do that, the parameter for include can be a string, btw, $PAGE is not equal to $page
2. nope, can be any extension, usually people use inc
3. its totally up to u, ppl use full name as its easier to debug, ppl use abbreviation because they dont wan the end user to know what is passed in the url
4. yes, its can be anything, just make sure you $_GET['act'] the correct variable

[classicgas]

PLEASE READ THIS CAREFULLY!!!!!!
What you are doing using the include function may seem like a good idea but is a huge secuirity risk!! php doesnt care if the value you give it is local or remote. so someone could missues that to import a page that could reveal details such as you passwords.

If you did it throught the header someone could do something like this

http://www.yoursite.bithat.com/index...r.com/hack.php

and php would still include it. You need to add some script in that will say strip the "http://" sdubstring in $page or someone could hack you easly!

[thedenizens]

lol i have a solution to that :) Try:

if(isset($HTTP_GET_VARS['page'])) {
$file_load = $HTTP_GET_VARS['page'];
$base_url = "[put your host here, eg: http://www.yourhost.com/]";
include($base_url . $file_load . ".php");
}

That way to be able to do the hack thing you were talking about, classicgas, they would have to have access to your server anyway, to be able to put anything in past the $base_url, you see?

lol I kno thats not hard, i just wanted to make sure :)

hixy