0

I try to make a single entry point site. here is my routing in the index.php

        $page = 2;
        $command = 3;
        $requestURI = explode("/", $_SERVER['REQUEST_URI']);

        if (!$requestURI[$page]) {include_once ('home.php');}
        else if (file_exists($requestURI[$page].".php")) {include_once ($requestURI[$page].".php");} 
        else {include_once ("404.php");} 

my .htaccess

Options +FollowSymLinks
IndexIgnore */*
# Turn on the RewriteEngine
RewriteEngine On
#  Rules
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . index.php

if i go domain.com/subfolder/gallery it works fine the gallery.php is included, but if i go domain.com/subfolder/gallery/subfolder my js includes are messed up it look for them in domain.com/subfolder/gallery/js/

instead of at they right place: domain.com/subfolder/js/

i include them like this:

html

of cource all the css and img files are included wrong too. how can i fix it?

1 Answer 1

2

Use absolute file paths..

Your code is also vulnerable to Local File Inclusion.

2
  • @user1930254 you could filter out strings that are used in lfi ("..", "/", etc), but that is not really secure. The best way is to only include files that should be included (either create an array of allowed filenames and check if the requested file is in it or create a switch statement for each allowed file and include them there).
    – tim
    Jan 31, 2013 at 21:16
  • 1
    preg_match("/^[a-z]$/", $requestURI[$page]) && file_exists... would be a good start but they could still read files limited to that directory. Google is your friend
    – fmrk
    Jan 31, 2013 at 21:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.