[PHP] Help Required

So I have a script that I have used for some time, and as I lost the contents of my HDD :glare: I decided I would re-build it.

PHP Code:

---

<?php
    $page = $_GET['p'];
    $page = preg_replace('/[^a-zA-Z0-9 \._-]/','',$page);
      if(!isset($page))
      {
        get_magic_quotes_gpc(include("home.php"));
      }
      elseif(file_exists("". $page . ".php"))
      { 
        include(stripslashes("" . $page . ".php"));
      }
      else
      {
        print("The page <b>" . $page . ".php</b> does not exist.");
      }
    ?>

---

What I need help with is the

PHP Code:

---

stripslashes 


---

as when I use CHARS such as

Code:

---

' or "

---

it will return them with

Quote:

---

Should be: 'BETA' - Output: "‘Beta’"

---

Guys, any help? :thumbup:

You shouldn't have quotes or apostrophes or any special characters in your file-names. Besides, they get stripped out with preg_replace() higher up in your script, anyway.

Quote:

---

Should be: 'BETA' - Output: "‘Beta’"

---

Also, that above quote is very confusing. What are you getting from your script, and what do you expect? I can't figure out which is which.. Neither of those should be coming out of your script because of the preg_replace() :S Also, why would you want either of those in a file-name? I just don't get it :(

Quote:

---

Originally Posted by s-p-n

You shouldn't have quotes or apostrophes or any special characters in your file-names. Besides, they get stripped out with preg_replace() higher up in your script, anyway.


Also, that above quote is very confusing. What are you getting from your script, and what do you expect? I can't figure out which is which.. Neither of those should be coming out of your script because of the preg_replace() :S Also, why would you want either of those in a file-name? I just don't get it :(

---

The Preg is to remove chars from file names so that does not change my question.

The code out-puts the file like an iframe using the GET function, when the page displays it outputs ' and " as a mix of symbols and letters, the stripslashes should fix that but I can't seem to place it correctley. :thumbup:

Quote:

---

Originally Posted by kaB00M

The Preg is to remove chars from file names so that does not change my question.

The code out-puts the file like an iframe using the GET function, when the page displays it outputs ' and " as a mix of symbols and letters, the stripslashes should fix that but I can't seem to place it correctley. :thumbup:

---

if your going to use preg to get pages. why not use

PHP Code:

---

<?php
$page = (string) $_GET['p'];
if(!file_exists($page.".php")) {
    print("The page <b>" . $page . ".php</b> does not exist.");
} else {
    include($page.".php");
}
?>

---

EDIT:
looking at your preg_replace: so you want all the text to be replaced with nothing?

it works like this. preg_replace(text, replacement, $page);
you have it like this preg_replace(text, NULL(same as nothing there), $page);

Quote:

---

Originally Posted by holthelper

if your going to use preg to get pages. why not use

PHP Code:

---

<?php
$page = (string) $_GET['p'];
if(!file_exists($page.".php")) {
    print("The page <b>" . $page . ".php</b> does not exist.");
} else {
    include($page.".php");
}
?>

---

EDIT:
looking at your preg_replace: so you want all the text to be replaced with nothing?

it works like this. preg_replace(text, replacement, $page);
you have it like this preg_replace(text, NULL(same as nothing there), $page);

---

index.php?p=../../mysupersecretphpcodeomg

Holthelper, the '^' character in his preg_replace means 'everything except' in PHP's REGEX. So he's stripping out 'everything except' [a-zA-Z0-9 \._-]. He desperately needs that, as Theoretical, in so little words, explained.

@OP,
Oh you want to get the file as a string, and use stripslashes on that. But wait, do the quotes show as:

Code:

---

&quot[;] or \"

---

?

If &quot, use html_entities_decode(), if it has a slash in front, use stripslashes. The file shouldn't have slashes unless you added them when you created the file :/ Which is unnecessary, btw. Same thing with html_entities_decode shouldn't be needed unless you used htmlentities() on the file beforehand.

Oh, and you need to make the file a string via file_get_contents():

PHP Code:

---

echo html_entities_decode(file_get_contents($file));
// Or.. 
echo stripslashes(file_get_contents($file)); 


---

Quote:

---

Originally Posted by s-p-n

Holthelper, the '^' character in his preg_replace means 'everything except' in PHP's REGEX. So he's stripping out 'everything except' [a-zA-Z0-9 \._-]. He desperately needs that, as Theoretical, in so little words, explained.

@OP,
Oh you want to get the file as a string, and use stripslashes on that. But wait, do the quotes show as:

Code:

---

&quot[;] or \"

---

?

If &quot, use html_entities_decode(), if it has a slash in front, use stripslashes. The file shouldn't have slashes unless you added them when you created the file :/ Which is unnecessary, btw. Same thing with html_entities_decode shouldn't be needed unless you used htmlentities() on the file beforehand.

Oh, and you need to make the file a string via file_get_contents():

PHP Code:

---

echo html_entities_decode(file_get_contents($file));
// Or.. 
echo stripslashes(file_get_contents($file)); 


---

---

ahh. never seen it used that way. thats the reason i like switch with extract($_GET);