proper php programming

[NL_Rosko]

i've been searching for an good tutorial on howto implement proper menu navigation and switching content.

that's way i'm posting here, could not find it.

 

i have a menu structure and submenu structure. depending on the choice of the menu it should show content and of course the submenu.

i can programm it easily with switch or if statements etc.

 

Smarty is very easy to use for this purpose, but now i want to know if i should use seperate php files for each section in the menu so i can load the submenu

but then how do i deal with the user that has logged in securely (sessions or define constants)

or switch the content depending on the url ?

 

so two questions:

- how to proper set up navigational structure

- if separate files with seperate templates then use session to check if user is logged in

 

i hope someone can push me in the right direction here.

I guess this question is the fundament of php website programming and need to understand it completely.

 

thanks.

[PHP Monkeh]

Personally I think the best option (and what I use) is just by using GETs from the URL (which you mentioned).  It's a very good way in my opinion for navigation.  Although it is a bit vulnerable to users inputting values they want in to the URL but with some good error handling you don't have to worry about that.

 

As for the user being logged in part I didn't get what you meant.  Are you only wanting to display certain parts of the menu to the user if they are logged in?

[NL_Rosko]

Personally I think the best option (and what I use) is just by using GETs from the URL (which you mentioned).  It's a very good way in my opinion for navigation.  Although it is a bit vulnerable to users inputting values they want in to the URL but with some good error handling you don't have to worry about that.

 

As for the user being logged in part I didn't get what you meant.  Are you only wanting to display certain parts of the menu to the user if they are logged in?

 

yes, bit strange question

what i meant was if i would use separate pages for home, registration etc. how do i check if an valid user is logged in.

but you said GET is the better option than this is not as issue.

 

problem is i have multiple different submenus depending on the main menu, like an actual application 

 

so the option will be then index.php?id=1 (home), =2 (registration) (will use htaccess to clean this up)

then use switch to load the content and submenu ? is that the best way to do this then ?

[PHP Monkeh]

Look up using sessions or cookies to see if a user is logged in or not.

 

As for including separate files depending on which page id they choose, you could use a switch like:

 

switch($_GET['id']) {

case '1':
include("home.php");
break;

case '2':
include("registration.php");
break;

default:
echo "You didn't enter a valid page ID!"; // The user is trying to access something they shouldn't
break;

}

 

You could use that for your menu then

[Psycho]

what i meant was if i would use separate pages for home, registration etc. how do i check if an valid user is logged in.

 

persoanlly I use a single script/page to check the user's login/rights and call that at the beginning of every applicable page.

[NL_Rosko]

what i meant was if i would use separate pages for home, registration etc. how do i check if an valid user is logged in.

 

persoanlly I use a single script/page to check the user's login/rights and call that at the beginning of every applicable page.

 

You use an login.php for example, set an variable or session, include it at every page that needs an valid login. ?

does it slow down the response. How would you accomplish this then ?

 

 

[haku]

Set a session variable (call it whatever name you want) after the person logs in, then check to see if that cookie exists at the top of every page that the person needs to be logged in to see. If the cookie is there, let them see the page. If the cookie isn't there, forward them to a different page.

[Psycho]

what i meant was if i would use separate pages for home, registration etc. how do i check if an valid user is logged in.

 

persoanlly I use a single script/page to check the user's login/rights and call that at the beginning of every applicable page.

 

You use an login.php for example, set an variable or session, include it at every page that needs an valid login. ?

does it slow down the response. How would you accomplish this then ?

 

 

It all depends on how secure you want the applicatin to be. For instance, if you have a system where an administrator can disable access to a user and that change needs to take place "immediateky" then you need to check the user's credentials on every page load. However, if those changes only need to be checked at the start of each session, then you can refer to the session value.

 

In any case, the method of checking for logged in or rights just needs to be written once and included on every page. That is the reason it should be a separate file. That way you can modify that method for the entire site in one fell swoop.

[NL_Rosko]

 

 

It all depends on how secure you want the applicatin to be. For instance, if you have a system where an administrator can disable access to a user and that change needs to take place "immediateky" then you need to check the user's credentials on every page load. However, if those changes only need to be checked at the start of each session, then you can refer to the session value.

 

In any case, the method of checking for logged in or rights just needs to be written once and included on every page. That is the reason it should be a separate file. That way you can modify that method for the entire site in one fell swoop.

 

It has to be secure, sessions should not be hijjacked for instance. after that level security is enough.

 

Is this ok in the PHP world ? or does this need an different approach ?

 

index.php?id=1&mod=reg

 

switch id

case 1 //main pages

include

break

etc.

 

switch mod //submenu pages

case reg

include

break etc.

 

 

 

 

 

[Psycho]

Absolutley NOT! Never use variables on the query string to determine logged in/admin status. The user can simple change the query to give themselves access they should not have.