[Raman]

Hi. I wanted to know how everyone does their tabbed pages here (kinda like macnn and apple).

Here's how I did mine today:

Drew the 2 sets of tabs including the tab text in fireworks, sliced each tab named it home_on.gif and home_off.gif and whatever_on.gif and whatever_off.gif

Then in ASP i created an array of 10 items, each corresponding to the first part of the name of my tab (ie. tabs(0)="home"

at the top of the page i figured out what page was being called from looking at the querystring and as i looped thru the array i wrote the

<a href="thispage.asp?page={variable}>< img src="{variable_on or _off.gif}" border=0</a>

That way whatever page you're on now is the tab who's "on" image is shown, the rest "off" image is shown.

How do you do it?

I did texacous.com, allcovered.com, and formulafinish.com in a similar way using ASP and using a querystring and the file system object to "dynamically include" whatever file.

yes, i know PHP can conditionally truly include files but my work is a M$ shop only

[funkboy]

I do mine that same way, too, but with PHP.

I simply have a showpage.php file, and I make links that look like
showpage.php?page=whateverpage
and I have everything related to that page named with "whateverpage."

If the page is "calendar" then I'll have:
- a calendar.gif and calendar_f2.gif (I used to have FireWorks do my rollovers, now it's a habit) image for the up and down states
- a calendar.html file somewhere for showpage to insert into the document

I've used this on a couple of the sites in my

Nice texaco page.portfolio, they're near the top.

I'd like to create an easier-to-use web-based editing engine for my clients to edit the pages themselves easier, but I've been having some trouble getting different things working. Working with other people's servers (especially when you have no direct contact with the server admin) makes it tougher, definitely... if anyone has any MySQL space available, I'd be glad to use it

[Millennium]

Originally posted by funkboy:
<STRONG>I do mine that same way, too, but with PHP.

I simply have a showpage.php file, and I make links that look like
showpage.php?page=whateverpage
and I have everything related to that page named with "whateverpage."

If the page is "calendar" then I'll have:
- a calendar.gif and calendar_f2.gif (I used to have FireWorks do my rollovers, now it's a habit) image for the up and down states
- a calendar.html file somewhere for showpage to insert into the document

I've used this on a couple of the sites in my

Nice texaco page.portfolio, they're near the top.

I'd like to create an easier-to-use web-based editing engine for my clients to edit the pages themselves easier, but I've been having some trouble getting different things working. Working with other people's servers (especially when you have no direct contact with the server admin) makes it tougher, definitely... if anyone has any MySQL space available, I'd be glad to use it </STRONG>

Although your method works, be EXTREMELY careful with it. If you don't do it right, you've opened up a massive security hole in your site.

It's not even all that hard to exploit. Consider: you expect people to only click links to get to your pages. "calendar" goes to calendar.html and so on. But what if someone were to, say, type in "page=../index"? That would, logically, get the index.html page of the directory above, if there was one. With some careful finagling, though, it's possible to grab any file on the system in this manner.

Luckily, with some code changes, you can keep this from happening. Just examine your "page" variable before doing anything with it. If it's not "calendar" or any of the other pages that it's supposed to go to, throw a 404.

[funkboy]

Originally posted by Millennium:
<STRONG>
Although your method works, be EXTREMELY careful with it. If you don't do it right, you've opened up a massive security hole in your site.</STRONG>

Yes, that possibility was in my mind when I wrote it. As it stands right now, that hole could still be exploited... so don't do that, folks! :-)

However, to my knowledge I have no secure documents on my server, and those that are are named in a fashion that no one could guess them (maybe some random-generation file name thingy could get them I suppose, but then they could probably crawl thru the directories themselves anyway) .

I do realize the hole, and I should probably just compare the input page to a list of known pages... I will sometime here... are there any files on a server that the user should defeinitely not be seeing, tho? There are no passwords or usernames or anything like that in any files I've created... could someone view some others I haven't made through this method?

[Raman]

I did a select case...else.. in my querystring if you put anything other than what the hard-coded page names are,(or anything else that would raise an error that can be trapped) it goes to the default page.

Another nice thing about it is that if anyone needs a "static" version of the website, I can just web-whack it and do a global find/replace to fix the querystring linking so that it doesn't use it. Took 5 minutes to do when the business owner wanted to put the demo site on one of those 3" business card cd's.

BTW, design is not my schtik - I'm a left-brained developer. I got forced into doing some of the sites for Shell/Texaco cause the other developers don't even know how to spell fireworks