Reduce redundancies in switch functions?

Kris.thedriftdemon · December 20, 2009

Hello all! I somewhat new to PHP, and was wondering if anyone could give some suggestions on a switch function to reduce redundancies, and to efficaciously implement the script on to other sites.


<?php 

$choice=$_GET['act'];

switch($choice)
{
case 'about':
if(file_exists("includes/about.php"))
include("includes/about.php");
break;


case 'contact':
if(file_exists("includes/contact.php"))
include("includes/contact.php");
break;


default;
include("includes/about.php"); } 

?>

rajivgonsalves · December 20, 2009

if your using the file_exists function you won't really need the switch

$choice= $_GET['act'];

include (file_exists("includes/$choice.php")  ? "includes/$choice.php" : "includes/about.php");

ignace · December 20, 2009

define('URI_ROOT', dirname(__FILE__) . DIRECTORY_SEPARATOR);
define('URI_PAGES', URI_ROOT . 'pages' . DIRECTORY_SEPARATOR);

function render($page, $variables) {
    $page_path = name2path($page);
    if (!@require_once($page_path)) {
        trigger_error("Page $page_path could not be loaded.");
        header('HTTP/1.0 404 Not Found');
        exit(0);
    }
}

function name2path($page) {
    return URI_PAGES . $page . '.php';
}

$default_page = 'about';
$request = array_merge($_GET, $_POST);
$page = isset($request['page']) ? $request['page'] : $default_page;
if (!preg_match('/[a-z]/', $page)) {
    trigger_error("Incorrect page format given: $page");
    render('error', array('errors' => 'Page not found.'));
    exit(0);
}

render($page, $request);

Kris.thedriftdemon · December 20, 2009

Ok! Not necessarily the answer I was looking for, but I understand. What I was thinking about was something like this.


<a href="index.php?act=$page1"><li>About</li></a>
<a href="index.php?act=$page2"><li>Contact</li></a>

<?php

$page1     = include("includes/about.php") ;
$page2     = include("includes/contact.php") ;
?>

<?php 

$choice=$_GET['act'];

switch($choice)
{
case '$page1':
if(file_exists('$page1'));
break;



case '$page2':
if(file_exists('$page2'));
break;


default;
include('$page1'); } 

?>

ignace · December 20, 2009

case '$page1': won't work neither will case "$page1" unless your user would type something like ?act=<!DOCTYPE html .. >\n<html ..>\n..

Kris.thedriftdemon · December 20, 2009

Sorry ignace! I didn't see you comment before I replied.

papaface · December 20, 2009

if your using the file_exists function you won't really need the switch
$choice= $_GET['act'];

include (file_exists("includes/$choice.php")  ? "includes/$choice.php" : "includes/about.php");

Couldn't that cause possible security issues as you can potentially include any file in the includes directory as long as it exists....

salathe · December 20, 2009

Couldn't that cause possible security issues as you can potentially include any file in the includes directory as long as it exists....

As long as the Apache user has read (and execute?) permissions, yes.

rajivgonsalves · December 21, 2009

if your using the file_exists function you won't really need the switch
$choice= $_GET['act'];

include (file_exists("includes/$choice.php")  ? "includes/$choice.php" : "includes/about.php");
Couldn't that cause possible security issues as you can potentially include any file in the includes directory as long as it exists....

Yes I though on that but since we prefix it with includes and postfix it with php the user will be including only php files, the file_exists will check if the file exists and execute, the user can execute the file directly from the browser giving http://www.site.com/includes/file.php so i ruled out that possibility

salathe · December 21, 2009

[ot] rajivgonsalves, and if the submitted URL contains ?act=../../../../etc/passwd%00 (assuming that eventually got to the right place and it could be read)? :shy: [/ot]

rajivgonsalves · December 21, 2009

[ot] Yes i got it, did not thing of that one , we can put in some checks but then I guess we are back to square one[/ot]

ignace · December 21, 2009

@salathe would my solution work?

http://www.phpfreaks.com/forums/index.php/topic,281354.msg1333298.html#msg1333298

Kris.thedriftdemon · December 21, 2009

Thank you so much ignace! I got it working.

salathe · December 21, 2009

@salathe would my solution work?

It would "work" in the same way that rajivgonsalves's example also "works". They both do the job and also suffer from precisely the same problem: yours pretends to make an effort to filter the input (even though that doesn't help at all).

ignace · December 21, 2009

even though that doesn't help at all

How so? The way I see it you are limited to a-z so something like ../../. wouldn't work or am I missing something?

roopurt18 · December 21, 2009

Oh God here we go again with this nonsense.

Use a white list.

<?php
$good = array( 'contact', 'about', 'home', 'index' );
$requested = array_key_exists( 'page', $_GET ) ? $_GET['page'] : 'home';
if( in_array( $requested, $good ) ) include( $requested . '.php' );
else { header( 'Location: 404.php' ); exit(); }
?>

salathe · December 21, 2009

How so? The way I see it you are limited to a-z so something like ../../. wouldn't work or am I missing something?

You're missing something: the pattern just attempts to match any one single lowercase letter within the subject string. It makes no attempt to check that all of the characters within that string are lowercase letters.

ignace · December 22, 2009

Thx salathe it indeed only matches one single lowercase letter and I'm no Regex guru. Is it possible using Regex to create a pattern that will fail if a non-lowercase letter is found?

salathe · December 22, 2009

Sure, there are a couple of options (which can be tweaked depending on needs):

1. Match any single non-lowercase-character: /[^a-z]/

2. Match only if all characters are lowercase: /^[a-z]+$/D

Daniel0 · December 22, 2009

Re: http://www.phpfreaks.com/forums/index.php/topic,281354.msg1333298.html#msg1333298

Doing this:

if (!@require_once($page_path)) {
    // something
}

is not a good idea. include and its relatives return whatever the file returns; it doesn't return true on success and false on failure. A file may very well return false.

ignace · December 22, 2009

thanks Daniel

roopurt18 · December 22, 2009

@ignace

I highly recommend you read through the content on this site; with this site and a little practice you'll be proficient in regexp in no time:

http://www.regular-expressions.info/

Kris.thedriftdemon · December 29, 2009

Ok! My next question is how could I implement this with SEO friendly URIs?

+Thank you all! I know have a greater understanding of PHP.

rajivgonsalves · December 29, 2009

you can try out mod_rewrite

http://httpd.apache.org/docs/1.3/mod/mod_rewrite.html

Sign In

Reduce redundancies in switch functions?

Recommended Posts

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Join the conversation

Important Information