0

Okay so I have been looking at developing my own custom CMS system for a specific market and I have been looking through a few frameworks and the problem that I have with them is that they don't automate routing. In laravel, if I remember correctly to respond to a url like this you would do something like this:

Route::get('/user', function()
{
    return "This is a user";
});

This would essentially listen for a specific request. Now my idea to simplify this was to create an automated router. So what I did was setup an .htaccess file which took every request and directed it to index.php. It also took anything after the .com, so something like www.testsite.com/admin/pages/edit/5 and appended it as a get variable.

So in the example above I am passing four parameters of a single request:

admin   -   request path / used to signify a login check must be done before passing 
            them on to their request
pages   -   This would be the class or object
edit    -   This would be the method called from the class / object
5       -   This would be the actual row of the record in the database being edited

So I developed a router class which looks something like this:

class router {

     public $url;
     public $protectedPaths = array('admin','users','client');

     public function __construct() {
          $this -> url = explode('/', $_GET['url']);

          if($this -> url[0] == '') {
               $this -> loadDefaultView();
          } else {
               // Check to ensure that the path is not protected
               if(in_array($this -> url[0], $this -> protectedPaths)) {

                    // check to ensure user is logged in
                    if($_COOKIE['isLogged']) {

                         // This means that there is no action or model needed just a returned view
                         if($this -> url[2] == '') {

                              $this -> loadViewWithoutAction();

                         } else {
                              // we check to ensure there is a controller
                              if(file_exists(baseControllers .'controller.'. $this -> url[1] .'.php')) {

                                   // require that controller and instantiate it
                                   require baseControllers .'controller.'. $this -> url[1] .'.php';
                                   $obj = new $this -> url[1];

                                   // check to see if method exists
                                   if(method_exists($obj, $this -> url[2])) {

                                        if($_POST) {
                                             $data = $_POST;
                                        } else {
                                             $data = array($this -> url[3]);
                                        }

                                        // run method if necessary
                                        $data = call_user_func_array(array($obj, $this -> url[2]), $data);
                                        $this -> loadAdminView( $data );

                                   } else {
                                        $this -> loadErrorView();
                                   }

                              } else {
                                   $this -> loadErrorView();
                              }
                         }
                    } else {
                         header("Location: /auth/form");
                    }

               } else {

                    // we check to ensure there is a controller
                    if(file_exists(baseControllers .'controller.'. $this -> url[0] .'.php')) {

                         // require that controller and instantiate it
                         require baseControllers .'controller.'. $this -> url[0] .'.php';
                         $obj = new $this -> url[0];

                         // check to see if method exists
                         if(method_exists($obj, $this -> url[1])) {

                              // run method if necessary
                              $data = call_user_func_array(array($obj, $this -> url[1]), array($this -> url[2]));
                              $this -> loadPublicView( $data );


                         } else {
                              $this -> loadErrorView();
                         }

                    } else {
                         $this -> loadErrorView();
                    }

               }

          }
     }

So I would use a number of different if else statements and perhaps a switch to differentiate between different requests etc. Finally my question, is this bad practice to auto load a class and run a method. From what I've seen in the frameworks, this is all manual and I'm no expert so I'm assuming there is probably a reason for that. In addition, I found little to anything about automating PHP requests in OOP on the web.

I'd really like to automate this but at the same time I also do not want to cause security concerns. Oh and for any forms or personal information being input by users everything would be post or ajax to protect against hacking the url.

Thanks for any advice or answers in advance!

Tom Bird
  • 919
  • 2
  • 11
  • 27
  • Some security concerns: 1) How would the router determine the routes "automatically"? 2) Cookies such as $_COOKIE['isLogged'] can be easily changed by a user- better to store a value like this in the DB. 3) POST and AJAX do not protect against XSS attacks (or people submitting their own forms to your website) – sman591 Apr 06 '13 at 06:11
  • You would want a whitelist-like system for this, both for security and routing reasons. Create an array of different route requests and their handlers? – sman591 Apr 06 '13 at 06:17
  • Essentially each request would be defined in the url similar to laravel but automated so for instance:

    public url request example:
    www.testsite.com/users/view/6
    users would be the object, view would be the method in the object and 6 would be the users id

    Admin url request example:
    www.testsite.com/admin/pages/edit/34
    admin would signify a protected path where a login check would be done prior to running the method or object. Pages would be the object, edit would be the method and 34 would be the record you'd be updating.
    Does this make sense?
    – Tom Bird Apr 06 '13 at 06:26
  • @sman591 Thanks for the heads up, I've never really run into XSS attacks, I've read something about them before didn't really understand what they are fully. I will definitely research that more. So if I stored the $_COOKIE['isLogged'] value in the database how do I pull that from page to page? – Tom Bird Apr 06 '13 at 06:30
  • Nor have I, but I've come to understand the basis of how they work and have actually used the same techniques to get into my own code. Assuming "isLogged" is reflecting a user's login session, store instead a random but secure (hash) into the cookie, and check your DB if there is a user with that current login. This also opens another security problem, but fixes the main one. – sman591 Apr 06 '13 at 06:35
  • http://stackoverflow.com/questions/549/the-definitive-guide-to-forms-based-website-authentication – sman591 Apr 06 '13 at 06:38
  • 1
    @sman591 Hey thanks buddy great example I will definitely look into this! – Tom Bird Apr 06 '13 at 15:50

0 Answers0