/    Sign up×
Community /Pin to ProfileBookmark

Is this OK?

Copy linkTweet thisAlerts:
Jan 30.2004

Hello.

I wonder if someone could tell me whether the below is ok, can you suggest ways I can improve the PHP security wise or suchlike, or do you think it’s ok?

It works perfect, I’m just wondering if anyone had any security comments or any suchthing.

Any help would be much appreciated!!!

Here’s the code:

[code=php]<?php
include(‘../header.php’);
?>

<table style=”text-align: center; margin-left: auto; margin-right: auto; border: 0px;” cellspacing=”0″ cellpadding=”0″>
<tr>
<td><b>Please click on a Question:</b></td>
</tr>

<tr>
<td>
<br />
<p>The questions.</p>
<br />
</td>
</tr>

<tr>
<td><b>The Answer:</b></td>
</tr>

<tr>
<td><br />
<?php

$id = (int)$_GET[‘id’];
if ($id <= 14 && $id >= 1) {

$info = “/home/LAN/public_html/faq/answers/$id.html”;

if (file_exists($info)) {
require($info);
} else {
echo “Sorry, that answer doesn’t exist. Please try again.”;
}

}
?>
<br /></td>
</tr>
</table>

<?php
include(‘../footer.php’);
?>[/code]

Thanks in advance.

Regards,

to post a comment
PHP

5 Comments(s) ↴

Copy linkTweet thisAlerts:
@pierskJan 30.2004 — Yes, that looks fine. What are you trying to do?
Copy linkTweet thisAlerts:
@DanUKauthorJan 30.2004 — Hi and thanks!!!

Well basically, I don't hav access to a DB (and I like this way better, more reliable etc) it's just basically to match the ?id=.. given and then bring up a corresponding .html file from that directory and insert it into that part of the table.

I believe it's pretty secure, i.e. it'll only load it if a correct ID is given (as it's 1 through 14.html), and it'll only load stuff from that directory, and only files ending in .html.

Just wondering if anyone had any other suggestions or suchlike.

Many thanks in advance.

Regards,
Copy linkTweet thisAlerts:
@pierskJan 30.2004 — Can I recommend that you don't use files with .html on the end, since then anyone can view them. Perhaps copy and paste the text from the .html files into .php files instead?
Copy linkTweet thisAlerts:
@DanUKauthorJan 30.2004 — Hi again piersk, thanks!

I did actually do this to begin with, but preferred this method as it was easier to adminster. It's not really a problem with people being able to view the html, the path isn't linked to anywhere (only by php which isn't viewable by users) and I could always do something like htaccess.

Thanks again.

Regards,
Copy linkTweet thisAlerts:
@DanUKauthorJan 31.2004 — Any other comments please guys? ?
×

Success!

Help @DanUK spread the word by sharing this article on Twitter...

Tweet This
Sign in
Forgot password?
Sign in with TwitchSign in with GithubCreate Account
about: ({
version: 0.1.9 — BETA 6.1,
whats_new: community page,
up_next: more Davinci•003 tasks,
coming_soon: events calendar,
social: @webDeveloperHQ
});

legal: ({
terms: of use,
privacy: policy
});
changelog: (
version: 0.1.9,
notes: added community page

version: 0.1.8,
notes: added Davinci•003

version: 0.1.7,
notes: upvote answers to bounties

version: 0.1.6,
notes: article editor refresh
)...
recent_tips: (
tipper: @meenaratha,
tipped: article
amount: 1000 SATS,

tipper: @meenaratha,
tipped: article
amount: 1000 SATS,

tipper: @AriseFacilitySolutions09,
tipped: article
amount: 1000 SATS,
)...