<?Php "I Need Help" ?>

[Flash-Gordon]

Heres the problem, i use an iframe on my site, that means all links are just telling a page to open with a target of _iframe or whatever i decide to call the ifram. This also means that if you right click a link and select open in new windo you will only get the page that is meant to open in the iframe and you wont still have the index page. I want to overcome this by using some sort of php code that i have seen where the URL would be similar to

http://www.yourdomainhere.com/iframe.php?=home

and that would load a designated page from the server called home.php

a simple example is ;

<?php
include("folder/" . $page . ".php");
?>

how would i get what i want ?

[schorhr]

So you want to force people to have pages open with the rest of your site. Well, you could look at http://forums.htmlcenter.com/showthread.php?s=&threadid=482 if that is what you mean. Now all you would need to do is to submit a parameter of what page to open in the iframe.

[Pilot-Doofy]

Just setup a database with all your pages in it and have like index.php?page=home or w/e

[pieoncar]

At 8/4/04 08:59 AM, Flash_Gordon wrote: http://www.yourdomainhere.com/iframe.php?=home

You left out the variable name, it would be ".../iframe.php?var=home".

Don't forget that the argument to include is relative to the directory where the script is located (in this case iframe.php). So if you have your PHP scripts in /cgi-bin on the webserver, it might be in an aliased folder or something, you might want to check that. And /cgi-bin on the webserver would probably be something like /var/www/htdocs/cgi-bin on the actual computer, rather than through Apache.

<?php
include("folder/" . $page . ".php");
?>

So the correct way to do this (using my ?var=home) would be something like:

<?php
$page = $_GET['var'];
// $_GET is the parsed arguments to the URL
include("/var/www/htdocs/myfolder/$page.php") or die("Error: incorrect argument.");
/* You don't have to . concatenate variables inside double quotes, and the "or die" part ensures that if they enter a bad filename they will only see the error message (and whatever output was before that). The flaw in this design is that if people put ?var=../../../../../../etc/passwd or something like that (URLencoded, of course), they could for instance retrieve your passwd file and attempt to brute force any accounts on your computer. But that isn't too hard to disable on the serverside. */
?>

[Flash-Gordon]

thnx for trying to help, but lol im more confused now...

[gavD]

I would NOT do it like this,

You see you open yourself up to a directory traversal exploit. (see www.hackquest.com, there's a challenge on there that does exactly this)

What I would do is have page IDs.

In pseudocode:

switch($pageID) {
case 0:
include("homepage.php");
break;
case 1:
include("contact.php");
break;
}

et cetera. Note that I'm not giving EXACT code, just a suggestion of how to acheive the effect you want.

[Flash-Gordon]

lol i still dont get it and plus i checked out that web site and couldnt find the contest....