How can I use a GET url to identify if the user is accessing the backend?

Question

I made a PHP framework with my own templating system, which works as I want it to in the frontend. The templating system uses the ?url=($page) part of the of the URL to figure out what page the user requests, then displays the content of the file with the name ($page). I then use htaccess to "pretty up" the URL.

However, I'm now expanding the framework to identify if $_GET['url'] contains backend, and if it does, see if it has a trailing slash with another string. For example, if the value of $_GET['url'] is backend/manage-gallery, I want it to return the page manage-gallery from within the the backend folder. Here is the code that I have now. Currently, I got it to retrieve a page statically (index.php) if the value of $_GET['url'] is backend.

public function addTpl() {     
    global $zip;

    if(!isset($_GET['url']) || empty($_GET['url'])) {
        $_GET['url'] = 'index';
    }

    $front = '_zip/_templates/_front/'. $zip['Template']['Front'];
    $back  = '_zip/_templates/_back/'. $zip['Template']['Back'];

    if(strpos($_GET['url'], 'backend') !== false) {
       if(file_exists($back . '/')) {
            if(file_exists($back . '/index.php')) {
                ob_start();
                include($back . '/index.php');
                $this->tpl .= ob_get_contents();
                ob_end_clean();
            } else {
                if($zip['Template']['Front'] == 'Refresh/multi-page') {
                    ob_start();
                    include($back . '/404.php');
                    $this->tpl .= ob_get_contents();
                    ob_end_clean();
                } else {
                    die(zipError('File Not Found', 'The file <b>' . secure($_GET['url']) . '</b> could not be found. Please re-check the URL; If you were directed here using a link, please report that link <b><a href="mailto:[email protected]">here<a/>.</b>'));
                }
            }
        } else {
            die(zipError('Template Not Found', 'The template <b>' . $zip['Template']['Front'] . '</b> could not be found. Please check your configuration file for a mistake.'));
        } 
    } else {
        if(file_exists($front. '/')) {
            if(file_exists($front. '/' . secure($_GET['url']) . '.php')) {
                ob_start();
                include($front. '/' . secure($_GET['url']) . '.php');
                $this->tpl .= ob_get_contents();
                ob_end_clean();
            } else {
                if($zip['Template']['Front'] == 'Refresh/multi-page') {
                    ob_start();
                    include($front. '/404.php');
                    $this->tpl .= ob_get_contents();
                    ob_end_clean();
                } else {
                    die(zipError('File Not Found', 'The file <b>' . secure($_GET['url']) . '</b> could not be found. Please re-check the URL; If you were directed here using a link, please report that link <b><a href="mailto:[email protected]">here<a/>.</b>'));
                }
            }
        } else {
            die(zipError('Template Not Found', 'The template <b>' . $zip['Template']['Front'] . '</b> could not be found. Please check your configuration file for a mistake.'));
        }
    }
}

How can I make my code check if the get value contains backend, AND see if it has a traling slash with a string after it? Here is my htaccess

RewriteEngine On
RewriteRule ^(|/)$ index.php?url=$1
RewriteRule ^([a-zA-Z0-9_-]+)(|/)$ index.php?url=$1

Answer 1

Since the slash will always be right after the backend string, I would change the strpos by adding the slash:

if(strpos($_GET['url'], 'backend/') !== false) {

Also, if backend occurs in the string, it will always be at the beginning of the string, so I would look for it at position zero:

if(strpos($_GET['url'], 'backend/') == 0) {

Then, I would use && and add another condition to that if statement to check to see if the string is longer than 7 characters. In other words, if backend/ is at the beginning, and the string is longer that 7 characters, there are more characters after backend/.

if(strpos($_GET['url'], 'backend/') == 0 && strlen($_GET['url']) > 7) {

EDIT: There is a problem in your .htaccess file. Change $1 to $2.