# Member restricted game with API

My website is poorly coded.

The structure is pretty simple:

• A RewriteRule redirects /.... to /index.php?page=$1 • mypages/page.php contains the page content and actions (model controller and view glued together...) • index.php wrap the demanded page into a theme (basically include header and footer around it) The site is a complex MMORPG site (~40 differents pages). I need to convert each page to a view in my iPhone/Android app (probably made in JS+HTML with PhoneGap). So I guess I'll have to create an API and separate the model/controller/view on each page. I don't know how to manage the connection, but I'm sure I'm doing it in a bad way (see code below). My controller looks like this: <?php // Database connection, get$_GET("page") ...
if (file_exists($page)) { if(isMemberRestricted($page)) {
$loadUserInf = TRUE; if(!isValid($_SESSION['usern'], $_SESSION['passw'],$db)) {
if(!isValid($_COOKIE['cookie_password'] ,$_COOKIE['cookie_password'], $db)) { if(!isValid($_POST['usern'], $_POST['passw'],$db)) {
if(isValid($_POST['usern'],$_POST['passw'], $dbt)) {$page = CONTROLLER_PATH . "/desarchivage.php";
}
else {
$page = CONTROLLER_PATH . "/notConnected.php"; }$loadUserInf = FALSE;
}
}
}
else { // not yet connected
if($loadUserInf) // but connexion accepted connexion (); } } if($loadUserInf) {
pageRoutine(); // Stuff to do on each member restricted page
}
} else {
$page = CONTROLLER_PATH . "/404.php"; } require ($header);
require ($page); require ($footer);
?>


I really don't know where to start. I've read about MVC/API. I understood the theory, but I don't know where to begin with an existing project.

If a person requests ?page=mypage.php you check or that file exists if so, you include it. this means that your filesystem is hardcoded with your routing. Everytime you change a file-name, your routes also change. Also, some file-systems are case-sensitive (oh oh!)
Another thing that really bugs me is all the \$_ variables in your code. A better thing to do is to wrap them somehow (e.g. a Class or a set of functions). These functions would then have some validation in them. E.g. CSRF protection when _POST data is given, or instead of using the default php session handler, have your own that stores all session data in a database, ...