Databases
StackOverflow2013
Postsdbo
POIs this PHP code dangerous?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POIs this PHP code dangerous?
    primarykey
    data
    text
    <p>I've just sketched up the main index.php file. It should be the gateway for all the site requests. The reason why I want that is to have clean URLs.</p> <p>I have split my website into modules. (Example: register, articles etc..)</p> <p>Then I've included some lines in .htaccess, one is this:</p> <pre><code>RewriteRule ^([a-zA-Z0-9-]*)[/]?([a-zA-Z0-9-]*)[/]?([a-zA-Z0-9-]*)[/]?([a-zA-Z0-9-]*)[/]?([a-zA-Z0-9-]*)[/]?([a-zA-Z0-9-]*)[/]?([a-zA-Z0-9-]*)[/]?([a-zA-Z0-9-]*)[/]?([a-zA-Z0-9-]*)[/]?$ index.php?1=$1&amp;2=$2&amp;3=$3&amp;4=$4&amp;5=$5&amp;6=$6&amp;7=$7&amp;8=$8&amp;9=$9 [L,NC] </code></pre> <p>This just maps each "folder" to the right $_GET element... domain/1/hi/3</p> <pre><code>$_GET['2'] == 'hi'; // TRUE </code></pre> <p>So I want to run the module based on the first $_GET element. This way I can keep my project organized. And all files associated with a module is inside its folder.</p> <p>Here is my folder structure:</p> <pre><code>/ modules/ register/ ajax/ process.php register.php articles/ articles.php index.php </code></pre> <p>And here is the PHP-code to map everything (index.php):</p> <pre><code>&lt;?php $basePath = 'modules'; for ($x = 1; $x &lt;= 9; $x++) { if (preg_match('/[^a-zA-Z0-9-]/', $_GET[$x])) { require_once(__DIR__ . "/$basePath/404/404.php"); die(); } } $baseModule = $_GET['1']; if (file_exists(__DIR__ . "/$basePath/$baseModule/$baseModule.php")) { require_once(__DIR__ . "/$basePath/$baseModule/$baseModule.php"); } else { require_once(__DIR__ . "/$basePath/404/404.php"); } </code></pre> <p>Is this dangerous code? The reason why I do the regex is to check that the GETs doesn't contain . or / which could be used to do ../ and thus run virtually any file on the server...</p> <p>Does this still pose a security hole, a potential security hole, or is it in fact, bad practice?</p> <p>What is the best approach to this problem?</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USPeeHaa
    1. USStudent of Hogwarts
    plurals
    1. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POIs this PHP code dangerous?
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POIs this PHP code dangerous?
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POIs this PHP code dangerous?
      1. This table or related slice is empty.
      1. VTDownMod
    1. COWhy would you let anyone choose the filename - instead of making this choice by yourself (depending on params)?
      singulars
      1. POIs this PHP code dangerous?
      1. USraina77ow
    2. CO@raina77ow Are you suggesting using a switch with predefined calls depending on the input?
      singulars
      1. POIs this PHP code dangerous?
      1. USStudent of Hogwarts
    3. COExactly, if there are few files to use. Alternatively, you can extract some part of request (and this part will _always_ follow the rules you set) and `require` depending on it.
      singulars
      1. POIs this PHP code dangerous?
      1. USraina77ow
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload