Question

For this moment using this code:

if ($_GET['page'] == 'index' 
     and file_exists('./intl/tpl/' . $_GET['page'] . '.tpl') 
     or !file_exists('./intl/tpl/' . $_GET['page'] . '.tpl') 
     or !$_GET['page']) {
//code
} elseif ($_GET['page'] == 'multi' 
          and file_exists('./intl/tpl/' . $_GET['page'] . '.tpl')) {
//code 2
}

and so on…

Question 1: Does this code “good” ? Doesn’t need any escaping or something ?

Question 2: ?page=logout doens’t work, so i created logout.php which looks like:

<?php
require_once "./intl/config.php";
SessionDelete('logged_in');
SessionDelete('username');
SessionDelete('userid');
if ($user_admin != null) {
    SessionDelete('inadmin');
    if (SessionGet('s_order') != null or SessionGet('s_page_show_all') != null) {
        SessionDelete('s_order');
        SessionDelete('s_page_show_all');
    }
}
header('Location: '.$config['indexurl'].'index.php');
?>

Maybe before sessions delete need session start and it’s possible do that with ?page=logout ?

Answer 1

The code certainly can be improved:

1. Reorder the tests so that it will not generate E_NOTICE errors
2. Parenthesize so that operator precedence is immediately obvious
3. Use the && and || boolean operators (as garvey’s comment says)

Doing this, you ‘d have:

if (empty($_GET['page']) ||
    !file_exists('./intl/tpl/' . $_GET['page'] . '.tpl') ||
    ($_GET['page'] == 'index' && file_exists('./intl/tpl/' . $_GET['page'] . '.tpl')) {
//code
}
} elseif ($_GET['page'] == 'multi' && file_exists('./intl/tpl/' . $_GET['page'] . '.tpl')) {
//code 2
}

Then, rewrite it some more to make it clear why you are doing what you do. This will also allow you to write simpler code. Simple is good.

// This way it's obvious that 'index' is the default page
$page = !empty($_GET['page']) ? $_GET['page'] : 'index';

if (!file_exists('./intl/tpl/' . $page . '.tpl')) {
    $page = 'index'; // comment here saying that if a non-existing page is requested, we display the index instead
}

$template = './intl/tpl/' . $page . '.tpl';

// At this point, we know that $page has a value, and we know that $template exists, so:
switch($page) {
    case 'index':
        // code
        break;
    case 'multi':
        // code2
        break;
}

As for the second question: yes, you need to start the session before you are able to modify or destroy it.