error handling when requiring a page inside another which doesnt exist

[louis_coetzee]

Hi everyone,

 

I would like to know how I can customize the following error:

When I for example have a page called index.php inside I use require_once("menu.php")

Get this from my GET variable ex. id?=menu, how can I customize error instead of giving this: when page does not exist?

Warning: require(files/menu.php) [function.require]: failed to open stream: No such file or directory in C:\wamp\www\website\index.php on line 21

Fatal error: require() [function.require]: Failed opening required 'files/menu.php' (include_path='.;C:\php5\pear') in C:\wamp\www\website\index.php on line 21

to say: Page you have chosen does not exist.

 

Hope you will understand what I am trying to do.

[RussellReal]

file_exists

[trq]

if (isset($_GET['id'])) {
  if (file_exists($_GET['id'] . '.php')) {
    require_once $_GET['id'] . '.php';
  } else {
    echo "Sorry the page you are looking for does not exist";
  }
}

 

Be aware however that this still poses a security issue on some configurations. Much safer to provide an array of valid file names. eg;

 

$valid = array('home','about','blog');
if (isset($_GET['id']) && in_array($_GET['id'], $valid)) {
  if (file_exists($_GET['id'] . '.php')) {
    require_once $_GET['id'] . '.php';
  } else {
    echo "Sorry the page you are looking for does not exist";
  }
}

[printf]

You mean every page request you're going to do a file_exists(), that doesn't seem very smart. It's better to create a list of pages that exists within in the application and then place those in a switch() and throw an error if the $_GET['page'] is not in that list! The application should define the logic, not the incoming user data.

[landavia]

You mean every page request you're going to do a file_exists(), that doesn't seem very smart. It's better to create a list of pages that exists within in the application and then place those in a switch() and throw an error if the $_GET['page'] is not in that list! The application should define the logic, not the incoming user data.

but in my case

if the file_exits = false.. i give default id ^^ (main.php)

[trq]

You mean every page request you're going to do a file_exists(), that doesn't seem very smart. It's better to create a list of pages that exists within in the application and then place those in a switch() and throw an error if the $_GET['page'] is not in that list! The application should define the logic, not the incoming user data.

 

Theres no need for any switches. The list is a good idea however (see my code above) as file_exists can return true when given a remote file (on some configurations).

 

Still, even with a list of valid pages file_exists hould be checked to prevent errors.

[landavia]

i believe this is already solve.. what should we disscus again?

[louis_coetzee]

Can you please explain to me what types of security issues your talking about?

if (isset($_GET['id'])) {
  if (file_exists($_GET['id'] . '.php')) {
    require_once $_GET['id'] . '.php';
  } else {
    echo "Sorry the page you are looking for does not exist";
  }
}

 

Be aware however that this still poses a security issue on some configurations. Much safer to provide an array of valid file names. eg;

 

$valid = array('home','about','blog');
if (isset($_GET['id']) && in_array($_GET['id'], $valid)) {
  if (file_exists($_GET['id'] . '.php')) {
    require_once $_GET['id'] . '.php';
  } else {
    echo "Sorry the page you are looking for does not exist";
  }
}

[landavia]

he mean... someone will..or might inject your url..

i don't know how.. but better prepare.. and take the advise

[RussellReal]

file_exists returns TRUE or FALSE if the specified filename exists ornot..

 

NOW I think as of 4.6 or 5.0 file_exists now will return true or false for some urls

 

like

 

http://whatever.com/whatever.php

 

now.. if that exists on whatever.php then it will return  true, and then whatever code you have inside "whatever.php" that will be "included" into your page.

 

now if they have un-evaluated php inside of whatever.php then now they hacve control over your files