[SOLVED] Correct Way require_once?

[brent123456]

I am working on a website. I have one index.php page that I am using "?do=dosomething" in the url link like http://www.index.com?do=showthingpage. Then I am using a switch statement to check what the do is and switch($_GET['do']) then using "<? case showthingpage: ($isloggedin) ? require_once(/showthingpage.php) : require_once(/anon.php) ?>" to load the required page into my main div. I am using about 20 case statements to do this for about 20 pages for the site. Is it alright to do it this way and just use one index.php page then load the pages into the div or should I have a page for each one. I though it would be easier to maintain this way? Could someone help me with some advise? thanks ???

[The Little Guy]

Want to paste some code?

 

(use the code bb tags)

[Yesideez]

Personally I'd split the index file into smaller files if just to make it easier to maintain. The other reason is that if for some reason the 'do' parameter isn't supplied you could get the wrong page being served.

[brent123456]

Thanks, I put in a case for that as well case "": require_once(main.php)

Should I be worried about security or anything like that?

[trq]

There should be no need for 20 something case statements. Anytime you see repetativeness in your code, your probably not doing something right.

 

<?php

  $valid = array('page1','page2','page3'); // store an array of valid pages. Needed for security.
  if (isset($_GET['do'])) {
    if (in_array($_GET['do'],$valid)) {
      require_once $_GET['do'].'.php';
      exit();
    }
  }
  require_once 'main.php';

?>

[brent123456]

How would I stop a user from calling the page in the include folder directly? One that I have used in the require once? If if was a form script.

[trq]

If if was a form script.

 

I'll assume that was... If it was a form script.

 

If you have scripts that should only be requested via a form simply enclose them in a conditional to check they where posted to. eg;

 

<?php

  if (isset($_POST['submit'])) {
    // safe to say A form posted to this script
  }

?>

[brent123456]

Thanks thorpe you have been a big help. I was kind of wondering what I could do to stop a user if they call the page directly like http://www.index.php/includes/add_address.php instead of using the link supplied by the page output in

require_once $_GET['do'].'.php';

. If they go directly to the page then it doesn't get the proper $_GET variables that I have supplied in the link to the page. Some of my pages have http://www.index.php?do=add_address&userid=$userid links. If someone calls the script directly in the includes file it doesn't get this id information and generates a ton of errors when the page is submitted. Thank you for you help.

[Dragen]

use an isset to check.

<?php
if(!isset($_GET['userid'] || !isset($_GET['$othervariable']){
       echo 'Error: get method not set etc....';
       exit;
}else{
       //output page
}
?>

[brent123456]

Did I mention how awesome you people are? Thanks That will work great