Problem with including but why?

[craigtb]

I am working on a page and am using a simple include to use the same layout with different texts for every page.  When i created the links to all the pages i did it jsut like i've done on several other sites i've created but for some reason now it is just keeping the homepage text when i follow a link. Here is the code.

<a href="?id=pages/acid_stain.txt"><img src="images/index_08.gif" width="222" height="44"></a><br>
        <a href="?id=pages/epoxy.txt"><img src="images/index_09.gif" width="222" height="46"></a><br>
        <a href="?id=pages/paint_stain.txt"><img src="images/index_10.gif" width="222" height="45"></a><br>
        <a href="?id=pages/custom_design.txt"><img src="images/index_11.gif" width="222" height="44"></a><br>
        <a href="?id=pages/gallery.html"><img src="images/index_12.gif" width="222" height="46"></a><br>
        <a href="?id=pages/color_chart.html"><img src="images/index_13.gif" width="222" height="44"></a><br>
        <a href="?id=pages/contact.html"><img src="images/index_14.gif" width="222" height="47"></a></td>
        <td colspan="3"><img src="images/index_03.gif"
        width="520" height="13"></td>
        <td rowspan="12"><img src="images/index_04.gif"
        width="108" height="725"></td>
        <td><img src="images/spacer.gif" width="1" height="13"></td>
    </tr>
    <tr>
        <td rowspan="8" background="images/index_05.gif"> </td>
        <td align="center" valign="top" rowspan="8" width="498"><?php
if ($id == "") {
$id ="home.html";
}
include("$id");
?>

 

If anyone can help that would be great.

 

Also for some reason blue lines are appearing around the images/links. Does anyone know how i can get rid of those?

 

thanks in advance,

Craig

[madspof]

is there a live page i can look at

[trq]

You never define the $id variable. This....

 

<?php
if ($id == "") {
$id ="home.html";
}
include("$id");
?>

 

should be....

 

<?php
if ($_GET['id'] == "") {
$_GET['id'] = "home.html";
}
include($_GET['id']);
?>

 

PS: That code is extremely insecure. You need to validate that the files your including actually exist on your server. The way you have it setup anyone could run any php code they like on your site!

[craigtb]

Ok, that code you supplied worked, but i have used it the other way and it used to work. 

 

How would i go about making it more secure?

 

And does anybody know how to get rid of the blue lines that go around the images/links?

 

I only have it up on a local server so i cant exactly show it to you, sorry.

[trq]

I explained what you need to do to make it more secure.

 

The blue lines are either html or css related, not php.

[craigtb]

Ahh, sorry. But how do i validate that they are on my server?  Sorry I am not to knowledgeable on this topic.

[trq]

The easiest way is to make an array of valid files. Something like...

 

<?php

  $valid = array('home.html','foo.html','bar/html');
  if ($_GET['id'] == "") {
   $_GET['id'] = "home.html";
  }
  if (in_array($_GET['id'],$valid)) {
    include($_GET['id']);
  }

?>

Otherwise, you can use file_exists to validate a file.

[craigtb]

Ok, cool thanks, i'll try and implement it.

 

And if anyone is wondering the blue lines are because i forgot to put the border="0"

 

anywho thanks for the help!

 

[MadTechie]

not as secure as thorpe's, but a little more flexible

only include css&htm&html

if ($_GET['id'] == "") {
   $_GET['id'] = "home.html";
}
if (preg_match('/\.css$|\.html?$/si', $_GET['id']))
{
    include($_GET['id']);
}