10 replies to this topic

[microblogpl]

Hi!
Well.... I want to know how to make a script to create a html page. So when the script is executed, it will create a new page. Something like this: mydomain.com/test.html . The script should create the test.html page! Thanks in advanced......!

Here is my work:

<form action="index.php" method="post">
<input type="text" name="nick" value="Enter NIck" />
<input type="submit" value="Create" />
</form>

<?php

$nick=$_POST['nick'];	  // get the users input

$fh=fopen('$nick' , 'W')	// Create the page
$contents= include 'sys.php';
fwrite($fh, $contents);
fclose($fh);

echo "Redridectring to your page....";

header('Location: $nick');

?>

Now, what this code should do is create a page, which is called
$nick. So if the input is "bleugh", the $nick should be $nick="bleugh".
Then it will create the page "bleugh", include sys.php, then header to the
page. Is this wright? Plz answer!

follow me on twitter:
@microblogpl

[Orjan]

Don't understand what you are trying to achieve?

[microblogpl]

When a user inputs his nick, a page for him is created.... The page has has included sys.php......
Can enybody tell me whats wrong in my code, beckause it doesen`t work for me?

[Orjan]

You need to save the added pages somewhere, for example a database.
oh, you're into creating a new file. it's easiest just to copy the file then. http://php.net/manua...nction.copy.php

But I'd probably do a generic solution with a database instead.

[microblogpl]

Well, I don`t understand how to copy the file. That link you posted...... I don`t understand....
I`m quite new to php......

[Orjan]

This will make a copy of sys.php named whatever is sent into the form.

copy('sys.php', $nick . '.php');

It's far from a good thing to do in the long run. The best would be to create a database and store the unique things for each user there.

[Jmancuso]

hmm i am reading this and not sure if Orjan answered your question correctly.. i think your both on different pages.

from what i understand, you simply want to create a page based on whatever the user puts into the text field.

$myFile = "fileName.html";
$fh = fopen($myFile, 'w') or die("can't open file");
$stringData = "<whatever you want inside the html file>";
fwrite($fh, $stringData);

above is code i used to create files yesterday.

if im reading it right, you want it to do this

$myFile = "$nick";
$fh = fopen($myFile, 'w') or die("can't open file");
$stringData = "<?php include ('sys.php');?>";
fwrite($fh, $stringData);

[Upstream]

This will make a copy of sys.php named whatever is sent into the form.

copy('sys.php', $nick . '.php');

It's far from a good thing to do in the long run. The best would be to create a database and store the unique things for each user there.

hmm i am reading this and not sure if Orjan answered your question correctly.. i think your both on different pages.

from what i understand, you simply want to create a page based on whatever the user puts into the text field.

$myFile = "fileName.html";
$fh = fopen($myFile, 'w') or die("can't open file");
$stringData = "<whatever you want inside the html file>";
fwrite($fh, $stringData);

above is code i used to create files yesterday.

if im reading it right, you want it to do this

$myFile = "$nick";
$fh = fopen($myFile, 'w') or die("can't open file");
$stringData = "<?php include ('sys.php');?>";
fwrite($fh, $stringData);

I agree 100% with Orjan. Even when ignoring the downside to programming information statically into your scripts it is very, I repeat very UNSAFE to use file functions! Even more so if you do not know all the ins and outs of it.
This can be exploited in more than one way! It can be used to add, change or del any files on your server possibly making executing of server side code possible or the above can be used to insert malicious javascript to for example steal cookies from your users.

[hockey97]

This will make a copy of sys.php named whatever is sent into the form.

copy('sys.php', $nick . '.php');

It's far from a good thing to do in the long run. The best would be to create a database and store the unique things for each user there.

hmm i am reading this and not sure if Orjan answered your question correctly.. i think your both on different pages.

from what i understand, you simply want to create a page based on whatever the user puts into the text field.

$myFile = "fileName.html";
$fh = fopen($myFile, 'w') or die("can't open file");
$stringData = "<whatever you want inside the html file>";
fwrite($fh, $stringData);

above is code i used to create files yesterday.

if im reading it right, you want it to do this

$myFile = "$nick";
$fh = fopen($myFile, 'w') or die("can't open file");
$stringData = "<?php include ('sys.php');?>";
fwrite($fh, $stringData);

I agree 100% with Orjan. Even when ignoring the downside to programming information statically into your scripts it is very, I repeat very UNSAFE to use file functions! Even more so if you do not know all the ins and outs of it.
This can be exploited in more than one way! It can be used to add, change or del any files on your server possibly making executing of server side code possible or the above can be used to insert malicious javascript to for example steal cookies from your users.

No that isn't possible unless you allow your users to directly give the html code or give full rights on creating files.

I think OP is going to generate a html file. However, the user will be able to name the file whatever and use a GUI to create their own page. As long he dosen't allow them to toss code into those inputs and he generates all the code himself. This should be ok.

[Upstream]

This will make a copy of sys.php named whatever is sent into the form.

copy('sys.php', $nick . '.php');

It's far from a good thing to do in the long run. The best would be to create a database and store the unique things for each user there.

hmm i am reading this and not sure if Orjan answered your question correctly.. i think your both on different pages.

from what i understand, you simply want to create a page based on whatever the user puts into the text field.

$myFile = "fileName.html";
$fh = fopen($myFile, 'w') or die("can't open file");
$stringData = "<whatever you want inside the html file>";
fwrite($fh, $stringData);

above is code i used to create files yesterday.

if im reading it right, you want it to do this

$myFile = "$nick";
$fh = fopen($myFile, 'w') or die("can't open file");
$stringData = "<?php include ('sys.php');?>";
fwrite($fh, $stringData);

I agree 100% with Orjan. Even when ignoring the downside to programming information statically into your scripts it is very, I repeat very UNSAFE to use file functions! Even more so if you do not know all the ins and outs of it.
This can be exploited in more than one way! It can be used to add, change or del any files on your server possibly making executing of server side code possible or the above can be used to insert malicious javascript to for example steal cookies from your users.

No that isn't possible unless you allow your users to directly give the html code or give full rights on creating files.

I think OP is going to generate a html file. However, the user will be able to name the file whatever and use a GUI to create their own page. As long he dosen't allow them to toss code into those inputs and he generates all the code himself. This should be ok.

When you look at the original code this is a real problem as it takes the form data from the nick and places it directly in the output stream.

$nick=$_POST['nick']; // get the users input

I do not wan't turn it into more then it is but it is not good practice. If I am reading correctly then the suggested solution $myFile = "$nick" is also one to considder twice. Now $nick contains a file handle which is obtained directly from the input form. If you wan't I can give some exampe code which I think will do the trick. Maybe I am mistaken.

[BenW]

Upstream is correct, you should be extremely careful when allowing users to create pages in that way. Don't assume the user will only enter data that you ask them to. Learn about security and input validation before you make a page like that live to the internet.