The index file:

require_once 'app/run.php';

$_action = (isset($_GET['cmd']) && ctype_alnum($_GET['cmd'])) ? $_GET['cmd'] : 'index';

switch ($_action) {

    case 'index':
    case 'default':
    case 'home':
        include $con_dir . '/index.php';
        include $con_dir . '/404.php';


The run.php file:


require_once 'config.php';

$app_dir = realpath(dirname(__FILE__));
$lib_dir = $app_dir . '/lib';
$con_dir = $app_dir . '/controllers';

require_once($app_dir . '/lib.php'); //Include libraries

//Database Connection
try {
  # MySQL with PDO_MYSQL
  $db = new PDO("mysql:host=$hostname;dbname=$database", $username, $password);
catch(PDOException $e) {
    echo $e->getMessage();

$tpl = new Smarty();
$tpl->template_dir = $app_dir . '/Smarty/templates/';
$tpl->compile_dir  = $app_dir . '/Smarty/templates_c/';
$tpl->config_dir   = $app_dir . '/Smarty/configs/';
$tpl->cache_dir    = $app_dir . '/Smarty/cache/';

The lib.php file

require_once($lib_dir . '/Smarty/Smarty.class.php');

The config.php file

$hostname = 'localhost';
$username = 'root';
$password = '';
$database = 'engine';

I think I can improve this by doing the switch() more dynamic, let's say it, would it be possible to have that the ?cmd=filename would be appropriate, how would I do it? And how do I do it secure?

Else way what do you think about my basic structure, how should improve it? What would you change etc.


1 Answer 1


You code looks fine. One minor issue: in the catch(PDOException $e) branch maybe you want to

  • log the error (error_log),
  • show a fancy static error page to the user ("It's not your fault, we have logged the error and we're working on it." or something like this.),
  • and/or call die().

About the dynamic switch: I would use a whitelist array which prohibit including other files which are not in the array.

$pages['index'] = 'index.php';
$pages['default'] = 'default.php';
$pages['home'] = 'home.php';
$page = '/404.php'
if (isset($pages[$action])) {
    $page = $pages[$action];

include $con_dir . '/' . $page;
  • \$\begingroup\$ Is it possible to automatically create a new log file if it doesn't exists "error_log($e->getMessage() . "\n", 3, $log_dir . "/database.log");" \$\endgroup\$
    – John
    Nov 12, 2011 at 21:47
  • \$\begingroup\$ If it was question, yes, it's possible :-) \$\endgroup\$
    – palacsint
    Nov 13, 2011 at 9:44
  • 1
    \$\begingroup\$ Yeah, +1 for whitelisting pages instead of allowing any. I know my server logs frequently get people trying to abuse dynamic includes. \$\endgroup\$
    – Kzqai
    Nov 13, 2011 at 18:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.