MySQL PHP CMS URL creation(need to edit) - php

Question

I apologize for the length of this question, and would like to say thanks in advance.
Below is the snippet of code in question. I have a MySQL table that stores information from a custom built PHP MySQL CMS program based off of this tutorial:cms tutorial. As you can see in the List Pages and the Display Admin functions, the URL is built with the base url and the ID as well as the title. The ID is the primary key in the MySQL table that pulls all of the necessary information to be displayed on the page. How would I rewrite the code below so that it displays the title only in the URL and not the ID, but still go off of the ID as the unique identifier for displaying information in the pages?
From functions.php:
'// Display center bottom column
function centerbottomcolumn() {
if ($_GET['id']) {
$pageID = (int) $_GET['id'];
$result = mysql_query("SELECT centerbottomcolumn FROM pages WHERE id='$pageID'");
$row = mysql_fetch_array($result);
echo $row['centerbottomcolumn'];
} else {
$result = mysql_query("SELECT value FROM settings WHERE name='homePage'");
$row = mysql_fetch_array($result);
$pageID = $row['value'];
$result = mysql_query("SELECT centerbottomcolumn FROM pages WHERE title='$pageID'");
$row = mysql_fetch_array($result);
echo $row['centerbottomcolumn'];
}
}
// List the pages
function listPages() {
// List the home page first
$result = mysql_query("SELECT value FROM settings WHERE name='homePage'");
$row = mysql_fetch_array($result);
$homeID = $row['value'];
$result = mysql_query("SELECT title FROM pages WHERE id='$homeID'");
$row = mysql_fetch_array($result);
$homeTitle = $row['title'];
echo "<li><a href='" . BASE_URL . "/index.php'>$homeTitle</a></li>";
// List the rest of the pages
$result = mysql_query("SELECT id, title FROM pages");
while ($row = mysql_fetch_array($result)) {
// Do not list the home page twice
if ($row['title'] != $homeID) {
$pageID = $row['title'];
$pageTitle = $row['title'];
echo "<li><a href='" . BASE_URL . "/?id=$id&title=$pageTitle'>$pageTitle</a></li>";
}
}
}
// Display admin table
function displayAdmin() {
// Find the home page ID
$result = mysql_query("SELECT value FROM settings WHERE name='homePage'");
$row = mysql_fetch_array($result);
$homeID = $row['value'];
// Display a table
$result = mysql_query("SELECT id, title, date FROM pages");
echo '<table width="961">';
echo '<tr height="50">
<th align="left">ID</th>
<th align="left">Title of the Page</th>
<th align="left">Date Created</th>
<th align="left">Actions</th>
</tr>';
while ($row = mysql_fetch_array($result)) {
$id = $row['id'];
$title = $row['title'];
$date = date('M d, Y', $row['date']);
echo "<tr>
<td>$id</td>
<td><a href='". BASE_URL . "/id=$id&title=$title'>$title</a>";
if ($id == $homeID) {
echo ' <strong>(Home Page)</strong>';
}
echo "</td>
<td>$date</td>
<td><a href='edit.php?id=$id'>Edit</a></td><td>
<a href='confirm.php?id=$id'>Delete</a></td><td>
<a href='sethome.php?id=$id'>Set as Home</a>";
}
echo '</table>';
}
// Get array with page IDs
function getArray() {
$result = mysql_query("SELECT id FROM pages");
$IDs = array();
$i = 0;
while ($row = mysql_fetch_array($result)) {
$IDs[$i] = $row['id'];
$i++;
}
return $IDs;
}
From index.php:
(above head tag)
require_once 'functions.php';
connect();
$IDs = getArray();
(from body)
<?php if (in_array($_GET['id'], $IDs) || !$_GET): ?>
<?php centerbottomcolumn(); ?>
<?php else: ?>
<!-- Show a not found error -->
<p>Not found</p>
<?php endif; ?>'

Answer 1

You want your pages to show information based on a given ID but you don't want to pass the ID to the pages on the URL query string? You could POST the data to the target page instead of on the query string. You could invent a new ID that is a proxy for the real ID. But in general, you can't have a page do something based on user input (clicking a link with an ID in this case) without the input. If you want to hide the ID because it should be secret or you don't want people to be able to guess them, then you can replace your IDs with some kind of random guid that maps to the real (secret) ID in your database.