[PHP] Pages

[stian]

I personally find ruby so diffrent from everything else

class Book < ActiveRecord::Base
belongs_to :subject
validates_presence_of :title
validates_numericality_of rice, :message=>"Error Message"
end

Doesn't make much sence for people who never have used Ruby before

 

[Archez]

Doesn't make much sence for people who never have used Ruby before

Yeah.

 

[Paxton]

He asked after for a Smarty version on Polish board, the thread was deleted, but I recovered my code, someone might need it maybe.

ob_start();
require_once('Smarty.class.php');
include(((file_exists('pages/'.$_GET['page'].'.php')) ? 'pages/'.$_GET['page'].'.php'  : 'pages/404.php'));
$smarty = new Smarty;
$smarty->assign('content', ob_get_contents());
ob_end_clean();
$smarty->display('index.tpl');

Never tested it, wrote it within this small box

 

[stian]

Almost the same as I gave him .

 

[Paxton]

Difficult to write any other way

 

[Zonet]

Or:

if(!$_GET['page']) Header('Location: ?page=start');

switch($_GET['page']) {
	case 'start': include 'pages/start.php'; break;
	case 'login': include 'pages/login.php'; break;
	default:
		die 'Stop cheat ;p';
	break;
}

xPxP

You don't need to write break; on default:

 

[stian]

It is still a crappy method to make a page system...

 

[Zonet]

It is still a crappy method to make a page system...

Yeah, I always do like this..

<?PHP
$default_site = 'index';
if(isset($_GET['page'])) {
	if(file_exists('/pages/'.$_GET['page'].'.php')) {
		include_once('/pages/'.$_GET['page'].'.php');
		$title = ucfirst($_GET['page']);
	}
	else {
		header('Location: ?page='.$default_site);
	}
}
?>

 

[Kavvson]

<?php
$page = ((isset($_GET['page']) && $_GET['page'] != '') ? $_GET['page'] : 'home');
$page=(preg_match('/(\.\.|\/)/i',$page)?'home':$page);
$page = preg_replace('/[^a-zA-Z0-9 \._-]/','',$page);
$page = (file_exists('./pages/'.$page.'.php') ? $page : 'error');
include('./pages/'.$page.'.php');
?>

This works. Is the code good anyway? The safety?

 

[chojrak]

?page=/etc/shadow%00

<_<

Or not, won't bypass:

$page = (file_exists('./pages/'.$page.'.php') ? $page : 'error');

 

[stian]

./pages//etc/shadow.php?

 

[chojrak]

./pages//etc/shadow.php?

But with %00 it'd skip .php part, but still ./pages :/.

http://hakipedia.com/index.php/Poison_Null_Byte#Perl_PHP_Null_Byte_Injection

 

[stian]

Ye, sorry, '.php' was a typo, but the point is that it will be ./pages anyway