2
\$\begingroup\$

The index file:

<?php
require_once 'app/run.php';

$_action = (isset($_GET['cmd']) && ctype_alnum($_GET['cmd'])) ? $_GET['cmd'] : 'index';

switch ($_action) {

    case 'index':
    case 'default':
    case 'home':
        include $con_dir . '/index.php';
    break;
    default:
        include $con_dir . '/404.php';

}

The run.php file:

<?php
session_start();

require_once 'config.php';

$app_dir = realpath(dirname(__FILE__));
$lib_dir = $app_dir . '/lib';
$con_dir = $app_dir . '/controllers';

require_once($app_dir . '/lib.php'); //Include libraries

//Database Connection
try {
  # MySQL with PDO_MYSQL
  $db = new PDO("mysql:host=$hostname;dbname=$database", $username, $password);
}
catch(PDOException $e) {
    echo $e->getMessage();
}
unset($password);

//Smarty
$tpl = new Smarty();
$tpl->template_dir = $app_dir . '/Smarty/templates/';
$tpl->compile_dir  = $app_dir . '/Smarty/templates_c/';
$tpl->config_dir   = $app_dir . '/Smarty/configs/';
$tpl->cache_dir    = $app_dir . '/Smarty/cache/';

The lib.php file

<?php
require_once($lib_dir . '/Smarty/Smarty.class.php');

The config.php file

<?php
$hostname = 'localhost';
$username = 'root';
$password = '';
$database = 'engine';

I think I can improve this by doing the switch() more dynamic, let's say it, would it be possible to have that the ?cmd=filename would be appropriate, how would I do it? And how do I do it secure?

Else way what do you think about my basic structure, how should improve it? What would you change etc.

\$\endgroup\$
3
\$\begingroup\$

You code looks fine. One minor issue: in the catch(PDOException $e) branch maybe you want to

  • log the error (error_log),
  • show a fancy static error page to the user ("It's not your fault, we have logged the error and we're working on it." or something like this.),
  • and/or call die().

About the dynamic switch: I would use a whitelist array which prohibit including other files which are not in the array.

$pages['index'] = 'index.php';
$pages['default'] = 'default.php';
$pages['home'] = 'home.php';
$page = '/404.php'
if (isset($pages[$action])) {
    $page = $pages[$action];
}

include $con_dir . '/' . $page;
| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ Is it possible to automatically create a new log file if it doesn't exists "error_log($e->getMessage() . "\n", 3, $log_dir . "/database.log");" \$\endgroup\$ – John Nov 12 '11 at 21:47
  • \$\begingroup\$ If it was question, yes, it's possible :-) \$\endgroup\$ – palacsint Nov 13 '11 at 9:44
  • 1
    \$\begingroup\$ Yeah, +1 for whitelisting pages instead of allowing any. I know my server logs frequently get people trying to abuse dynamic includes. \$\endgroup\$ – Kzqai Nov 13 '11 at 18:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.