include php file

[raduenea]

I want to include a php file after an succesfully login.

Let's suposed that I have a login form on index.php. If the login was ok I want to include a php file with some content instead of the login form.

Something like:

<?
if($_POST['ok']){
     require('content.php');
} else {
//login form
}
?>

 

It's ok to include in the code the name of the file that you have on server ? From security point of view.

 

Thanks

[jeppers]

so from what i can see you want to be redirected to another page is that correct? and if so you could use a header file which will redirect the user after they have logged in

 

[raduenea]

no. the code that i mentioned is located in index.php

I don't want to make any redirect. Just to inclide the content.php file.

It's ok to include in that way ?

 

How other huge website include pages like this ?

 

[spiderwell]

theres nothing wrong with doing what you are suggesting. and the file name in the code won't be seen because its in the php code. it will be executed and what you will see is the output of the included file in the browser.

[fugix]

php is hidden from view source

[raduenea]

How about if I use a link like:

index.php?page=account

 

and in the code I have:

<?
if($_POST['ok']){
     require('account.php');
} else {
//login form
}
?>

 

It's a security issue ?

[Stooney]

Typically login systems are a bit more complex, but this would be a very basic example:

 

<?php
if($_POST['login_attempt']){
    //Attempt Login
}

if($_SESSION['logged_in']){
    require('account.php');
} else{
    require('loginform.html');
}

[raduenea]

So if I want to include multiple php file using the link for exemple:

 

index.php?page=account

or

index.php?page=add

 

I can use:

<?php
if($_SESSION['logged_in']){
    require($_GET['page'] . '.php');
} else{
    require('loginform.html');
}

 

It's ok ?

 

[spiderwell]

its not the end of the world, but it wouldn't take a genius to work out what was happening.

instead of calling it page for example call it something irrelevant. or pass a number that the receiving script can convert to a file with a switch statement for example.