Question

I’m new to stackoverflow and to php and I’m trying to code this right. What I am trying to do is eliminate the display of pages other than index.php but still include them by utilizing the address bar. For example, I’m trying to write a login script that includes a login.php file but handles all of the form’s post information and checks through the index.php file.

I’m trying to create a function to include only specific pages when called upon by the address bar. So the form’s action would be to index.php?act=login – I want to $_GET the act (login) and include login.php without the ability for users to include any other files that pose a security risk.

This is my code:

    function getContent() {

    $pages = array('login','page1');

    if(isset($_GET['act']) && $_GET['act'] == $pages) {
        include($_GET['act'] . '.php');
    } elseif (!isset($_GET['act'])) {
        echo 'INDEX PAGE';
    }
}

getContent();

Where am I going wrong? I can’t get the login.php page to display when index.php?act=login is set. The text “INDEX PAGE” displays just fine with act is not set.

Answer 1

This line of code is your problem:

 if(isset($_GET['act']) && $_GET['act'] == $pages) {

You need to change it to this (as you’re checking if the value of act exists in the array of pages):

if(isset($_GET['act']) && in_array($_GET['act'], $pages)) {

You might want to replace your elseif with a standard else, though. Because if $_GET['act'] is set, but isn’t in the array of pages, your elseif won’t be executed.

Furthermore, I’d strongly recommend you using a micro-framework like Limonade, which will handle this for you (much more safely), once you feel more familiar with PHP.