Help! Website state for CMS

Izi · 4 Feb 2010 at 17:41

I would like to know what would be the best way for me to manage state of a CMS I have built.

The problem I have is that there are multiple sections to a website. In each section different navigation is shown, different modules are pulled in etc.. So in order to do this I need to know which section the current user is looking at.

What would you suggest the best way of doing this is? Querystring or setting a session? I could use cookies, but isn't that bad practise if a browser doesnt support cookies?

Izi · 4 Feb 2010 at 19:31

ignore this.

I am going to use querystring with section as ID. I.E domain.com/sectionname

mod rewrite

Page.aspx?s=sectioname

then do a look up in site section.

unless anyone can let me know of a better way.

Confused · 4 Feb 2010 at 20:37

Make sure you properly sanitise your input if doing it that way!

suarve · 5 Feb 2010 at 09:16

Izi said:
ignore this.

I am going to use querystring with section as ID. I.E domain.com/sectionname

mod rewrite

Page.aspx?s=sectioname

then do a look up in site section.

unless anyone can let me know of a better way.

Yer kind of like how Joomla does it:

index.php?section=about&action=add&forum=ocuk

Izi · 5 Feb 2010 at 11:40

Confused said:
Make sure you properly sanitise your input if doing it that way!

you mean for SQL injection etc?

suarve · 5 Feb 2010 at 11:46

Izi said:
you mean for SQL injection etc?

Yes.

Also to stop your app breaking if someone changed the querystring.

Could try setting up an array of allowed views (E.g. view=add, view=delete etc.) and checking that the requested view is in the array of allowed views.

Say you have a number in the querystring E.g. view=edit&articleID=120 you should check that the article ID exists (else the edit view qwould be broken) and clean the article id from the querystring too before querystring the db to check. This stops sql injection and stops your app from breaking if (for whatever reason) someone added an invalid article ID to qs.

Just assume that every user is evil and wants to break you app

Izi · 5 Feb 2010 at 12:27

suarve said:
Yes.

Also to stop your app breaking if someone changed the querystring.

Could try setting up an array of allowed views (E.g. view=add, view=delete etc.) and checking that the requested view is in the array of allowed views.

Say you have a number in the querystring E.g. view=edit&articleID=120 you should check that the article ID exists (else the edit view qwould be broken) and clean the article id from the querystring too before querystring the db to check. This stops sql injection and stops your app from breaking if (for whatever reason) someone added an invalid article ID to qs.

Just assume that every user is evil and wants to break you app

i'm using linq 2 sql for data layer so that protects the sql injection stuff and I always do a check if my object is null (i.e wrong id/deleted id) and display a message if so.

even so, someone will always find a way to break something