Calling a function from a link

[bulevardi]

I would be extremely careful with that, that code will enable anyone to run any function they like on your server. Validate the function against a whitelist of allowed functions before calling it.

Perhaps, it can be done like this:
(wrote some quick validations)

<?php 
$fun = $_GET['fun']; 

if (empty($fun)) { 
standard(); 
} 
else 
{
if($fun != "function1" || $fun != "function2" || $fun != "standard") {
echo "do not mess with the code";
} else {
$fun();
} 
}
 
function standard() { 
echo "<a href=\"?fun=function1\">call function 1</a>";
echo "<a href=\"?fun=function2\">call function 2</a>";
} 
function function1() { 
if($fun != "function1"){ 
 echo "do not mess with the code";
} else {

 echo "this shows function one";
}   
function function2() { 

if($fun != "function2"){ 
 echo "do not mess with the code";
} else {
 echo "this shows function two";
}
}
 
?>

Or isn't this safe?

[guido2004]

The code I posted is safe.

This

if($fun != "function1" || $fun != "function2" || $fun != "standard") { 

doesn't work, because $fun can't have all 3 values at the same time.

[Stormrider]

Just create an array of allowed functions, and use in_array() to check if the submitted function is in the allowed list. Much easier to maintain.

[bulevardi]

I did this one now, like guido2004 did, but than without the switch cases.
(I guess I just have something against switches)

<?php 
$fun = $_GET['fun']; 

if (empty($fun)) { 
standard(); 
 } else {
if($fun == "function1" || $fun == "function2" || $fun == "standard") {
$fun();
} else {
echo "do not mess with the code";
} 
}
 
function standard() { 
echo "<a href=\"?fun=function1\">call function 1</a>";
echo "<a href=\"?fun=function2\">call function 2</a>";
} 

function function1() { 
 echo "this shows function one";
}   

function function2() { 
 echo "this shows function two";
}

?>

Anyway, it works, but is it secure?

[bulevardi]

The code I posted is safe.

This

if($fun != "function1" || $fun != "function2" || $fun != "standard") { 

doesn't work, because $fun can't have all 3 values at the same time.

Strange, if I turned it the other way, with

if($fun == "function1" || $fun == "function2" || $fun == "standard") { 

It works out real good now. Thnx !

[v1rgil]

you can't possibly call a server side script just like you do with javascript BUT you can use javascript to call a specific php function within a php file using query string.

[Stormrider]

Strange, if I turned it the other way, with

if($fun == "function1" || $fun == "function2" || $fun == "standard") { 

It works out real good now. Thnx !

That isn't turning it the other way. You'd have to change the || to && if you wanted to make it 'opposite'.

if (condition1 && condition2) {
 //dothing1
} else {
 //dothing2
}//if 

is equivalent to

if (!condition1 || !condition2) {
 //dothing2
} else {
 //dothing1
}//if 

[bulevardi]

you can't possibly call a server side script just like you do with javascript BUT you can use javascript to call a specific php function within a php file using query string.

But on my way here http://www.sitepoint.com/forums/show...0&postcount=29

Or on guido2004's way with the switch, it's possible to call php functions, even from the same script in the same page.

[Stormrider]

You aren't calling the function directly though, you are reloading the page which triggers the function call, that is what v1rgil meant.

You'd still be better off using an array of allowed functions.

$strFunctionName = $_GET['func'];

$arrAllowedFunctions = array('function1', 'function2', 'function3');

if (in_array($strFunctionName, $arrAllowedFunctions)) {
 $strFunctionName();
} else {
 default();
}//if

function default () {
//dosomething
}//function

function function1 () {
//dosomething
}//function

function function2 () {
//dosomething
}//function 

[bulevardi]

That isn't turning it the other way. You'd have to change the || to && if you wanted to make it 'opposite'.

Hmm yeah, I see. I made it up too quick I guess...
But:

if($fun == "function1" || $fun == "function2" || $fun == "standard") 
{ 
$fun(); 
} else { 
echo "do not mess with the code"; 
} 

is quite the same as:

if($fun != "function1" && $fun != "function2" && $fun != "standard") 
{ 
echo "do not mess with the code"; 
} else { 
$fun(); 
} 

or not ?

Anyway, you can turn it around as much as you want, but the actually question was if it is secure working with this validation in it or not?

[Stormrider]

Yes, those 2 bits of code are equivalent, and it would work fine for validation.

[bulevardi]

Hmm, I'll read a bit more about these array things later on this weekend. (I got to go now)
But you guys certainly helped me answering my questions !
Thanks!

[bulevardi]

Hmm, I'll read a bit more about these array things later on this weekend. (I got to go now)
But you guys certainly helped me answering my questions !
Thanks!

Still haven't got the time to read it, so...
... but will do later on !!