Using GET method php

Question

I now try to made admin panel and there want add 3 section:

Edit post
Remowe post
Add post

In file admin.php I using sesions, but I dont know how to seperate this 3 sections. I want use this method made 3 section in page admin.php:

/admin.php?id=edit
/admin.php?id=remove
/admin.php?id=add

I want ask you do this decision is correct ?

jonjbar · Accepted Answer · 2012-06-30 07:52:33Z

1

This is correct even though using POST is recommended as it is a little harder to play with for novice hackers. Also make sure you check user has right to access dangerous sections such as "edit" and "remove".

Also as a security recommendation, you should change the name of your admin.php file to something less easily findable: any prospective hacker has automated tools to try the most known admin section names to try to get in. If the name is unique, it will add a difficulty before even trying to break it.

edited Jun 30, 2012 at 7:52

answered Jun 30, 2012 at 7:46

jonjbar

4,1242 gold badges32 silver badges51 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Wizard Over a year ago

Ok, I will check, but this panel wiil be only for admin (1 user)

jonjbar Over a year ago

As many admin sections are, however anyone can try to call the "admin.php" page and try some known security issues or bad coding to get access.

Hamidreza · Accepted Answer · 2012-06-30 08:06:21Z

1

Your answer 'but I dont know how to seperate this 3 sections':

if(isset($_GET['id'])){
    switch($_GET['id']){
        case 'add':
            //your code
        break;
        case 'edit':
            //your code
        break;
        case 'delete':
            //your code
        break;
        default:
            //your code if some one pass anything else add/edit/remove
    }
}

Im using same way in my code and there is no problem, but you should check your code security.

Correct me if i'm wrong

edited Jun 30, 2012 at 8:06

answered Jun 30, 2012 at 7:58

Hamidreza

1,9254 gold badges29 silver badges44 bronze badges

Comments

10cool · Accepted Answer · 2012-06-30 08:21:53Z

0

I would structure the code in such a way so that every one of my admin pages inherited from a single secure base class. All subclasses can implement what ever functionally they need so you won't have one giant file and they can all easily be maintained from a security point of view. Your main entry point into the system can then be an admin.php page that invokes the right class and method based on your http params using a simple switch statement or other method to route the request.

answered Jun 30, 2012 at 8:21

10cool

1311 silver badge7 bronze badges

2 Comments

Wizard Over a year ago

Mhm I'm too thinking about this, but don't know how to separate this class method invocation, using of case will be correct idea to separate class invocation ?

10cool Over a year ago

So from a scalability point of view it might not be the best option. However for an admin page it should work fine. The simplest way I could think to do this it by including the class in the request, switch on class type, then new up an instance and call the method. If you want something that requires less maintenance you could leverage call_user_func(), put everything in a try catch and just use the request params to directly create an instance and make the function call. I've seen this scale well but its hard to understand and debug at times since its "magic"

Collectives™ on Stack Overflow

Using GET method php

3 Answers 3

2 Comments

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related