Jump to content


Check out our Community Blogs

Register and join over 40,000 other developers!


Recent Status Updates

View All Updates

Photo
- - - - -

How To Make A Php Script To Create A Html File?

help problem new file fopen

  • Please log in to reply
10 replies to this topic

#1 microblogpl

microblogpl

    CC Lurker

  • New Member
  • Pip
  • 3 posts
  • Location:Katowice, Poland
  • Programming Language:Java, PHP
  • Learning:JavaScript

Posted 25 July 2012 - 12:46 AM

Hi!
Well.... I want to know how to make a script to create a html page. So when the script is executed, it will create a new page. Something like this: mydomain.com/test.html . The script should create the test.html page! Thanks in advanced......! :laugh:

Here is my work:

<form action="index.php" method="post">
<input type="text" name="nick" value="Enter NIck" />
<input type="submit" value="Create" />
</form>

<?php

$nick=$_POST['nick'];	  // get the users input

$fh=fopen('$nick' , 'W')	// Create the page
$contents= include 'sys.php';
fwrite($fh, $contents);
fclose($fh);

echo "Redridectring to your page....";

header('Location: $nick');

?>

Now, what this code should do is create a page, which is called
$nick. So if the input is "bleugh", the $nick should be $nick="bleugh".
Then it will create the page "bleugh", include sys.php, then header to the
page. Is this wright? Plz answer! :rules:

follow me on twitter:
@microblogpl
  • 1

#2 Orjan

Orjan

    CC Mentor

  • Moderator
  • 2918 posts
  • Location:Karlstad, Sweden
  • Programming Language:C, Java, C++, C#, PHP, JavaScript, Pascal
  • Learning:Java, C#

Posted 25 July 2012 - 03:18 AM

Don't understand what you are trying to achieve?
  • 0

I'm a System developer at XLENT Consultant Group mainly working with SugarCRM.
Please DO NOT send mail or PM to me with programming questions, post them in the appropriate forum instead, where I and others can answer you.


#3 microblogpl

microblogpl

    CC Lurker

  • New Member
  • Pip
  • 3 posts
  • Location:Katowice, Poland
  • Programming Language:Java, PHP
  • Learning:JavaScript

Posted 25 July 2012 - 03:36 AM

When a user inputs his nick, a page for him is created.... :scared: The page has has included sys.php...... :rules:
Can enybody tell me whats wrong in my code, beckause it doesen`t work for me? :loading:
  • 0

#4 Orjan

Orjan

    CC Mentor

  • Moderator
  • 2918 posts
  • Location:Karlstad, Sweden
  • Programming Language:C, Java, C++, C#, PHP, JavaScript, Pascal
  • Learning:Java, C#

Posted 25 July 2012 - 03:39 AM

You need to save the added pages somewhere, for example a database.
oh, you're into creating a new file. it's easiest just to copy the file then. http://php.net/manua...nction.copy.php

But I'd probably do a generic solution with a database instead.
  • 0

I'm a System developer at XLENT Consultant Group mainly working with SugarCRM.
Please DO NOT send mail or PM to me with programming questions, post them in the appropriate forum instead, where I and others can answer you.


#5 microblogpl

microblogpl

    CC Lurker

  • New Member
  • Pip
  • 3 posts
  • Location:Katowice, Poland
  • Programming Language:Java, PHP
  • Learning:JavaScript

Posted 25 July 2012 - 04:00 AM

Well, I don`t understand how to copy the file. That link you posted...... I don`t understand....
I`m quite new to php......
  • 0

#6 Orjan

Orjan

    CC Mentor

  • Moderator
  • 2918 posts
  • Location:Karlstad, Sweden
  • Programming Language:C, Java, C++, C#, PHP, JavaScript, Pascal
  • Learning:Java, C#

Posted 25 July 2012 - 07:28 AM

This will make a copy of sys.php named whatever is sent into the form.
copy('sys.php', $nick . '.php');

It's far from a good thing to do in the long run. The best would be to create a database and store the unique things for each user there.
  • 0

I'm a System developer at XLENT Consultant Group mainly working with SugarCRM.
Please DO NOT send mail or PM to me with programming questions, post them in the appropriate forum instead, where I and others can answer you.


#7 Jmancuso

Jmancuso

    CC Regular

  • Member
  • PipPipPip
  • 45 posts

Posted 04 September 2012 - 05:28 PM

hmm i am reading this and not sure if Orjan answered your question correctly.. i think your both on different pages.

from what i understand, you simply want to create a page based on whatever the user puts into the text field.

$myFile = "fileName.html";
$fh = fopen($myFile, 'w') or die("can't open file");
$stringData = "<whatever you want inside the html file>";
fwrite($fh, $stringData);

above is code i used to create files yesterday.

if im reading it right, you want it to do this
$myFile = "$nick";
$fh = fopen($myFile, 'w') or die("can't open file");
$stringData = "<?php include ('sys.php');?>";
fwrite($fh, $stringData);

  • 0

#8 Upstream

Upstream

    CC Resident

  • Advanced Member
  • PipPipPipPip
  • 98 posts
  • Location:Netherlands
  • Programming Language:C, C++, PHP, (Visual) Basic, JavaScript, Perl, Bash, Others
  • Learning:Others

Posted 05 September 2012 - 08:37 AM

This will make a copy of sys.php named whatever is sent into the form.

copy('sys.php', $nick . '.php');

It's far from a good thing to do in the long run. The best would be to create a database and store the unique things for each user there.

hmm i am reading this and not sure if Orjan answered your question correctly.. i think your both on different pages.

from what i understand, you simply want to create a page based on whatever the user puts into the text field.

$myFile = "fileName.html";
$fh = fopen($myFile, 'w') or die("can't open file");
$stringData = "<whatever you want inside the html file>";
fwrite($fh, $stringData);

above is code i used to create files yesterday.

if im reading it right, you want it to do this
$myFile = "$nick";
$fh = fopen($myFile, 'w') or die("can't open file");
$stringData = "<?php include ('sys.php');?>";
fwrite($fh, $stringData);


I agree 100% with Orjan. Even when ignoring the downside to programming information statically into your scripts it is very, I repeat very UNSAFE to use file functions! Even more so if you do not know all the ins and outs of it.
This can be exploited in more than one way! It can be used to add, change or del any files on your server possibly making executing of server side code possible or the above can be used to insert malicious javascript to for example steal cookies from your users.
  • 0
"The question of whether a computer can think is no more interesting than the question of whether a submarine can swim." (Edsger Dijkstra)

#9 hockey97

hockey97

    CC Resident

  • Advanced Member
  • PipPipPipPip
  • 95 posts
  • Programming Language:C, C++, PHP, JavaScript, Bash
  • Learning:Assembly

Posted 06 September 2012 - 10:53 AM


This will make a copy of sys.php named whatever is sent into the form.

copy('sys.php', $nick . '.php');

It's far from a good thing to do in the long run. The best would be to create a database and store the unique things for each user there.

hmm i am reading this and not sure if Orjan answered your question correctly.. i think your both on different pages.

from what i understand, you simply want to create a page based on whatever the user puts into the text field.

$myFile = "fileName.html";
$fh = fopen($myFile, 'w') or die("can't open file");
$stringData = "<whatever you want inside the html file>";
fwrite($fh, $stringData);

above is code i used to create files yesterday.

if im reading it right, you want it to do this
$myFile = "$nick";
$fh = fopen($myFile, 'w') or die("can't open file");
$stringData = "<?php include ('sys.php');?>";
fwrite($fh, $stringData);


I agree 100% with Orjan. Even when ignoring the downside to programming information statically into your scripts it is very, I repeat very UNSAFE to use file functions! Even more so if you do not know all the ins and outs of it.
This can be exploited in more than one way! It can be used to add, change or del any files on your server possibly making executing of server side code possible or the above can be used to insert malicious javascript to for example steal cookies from your users.


No that isn't possible unless you allow your users to directly give the html code or give full rights on creating files.

I think OP is going to generate a html file. However, the user will be able to name the file whatever and use a GUI to create their own page. As long he dosen't allow them to toss code into those inputs and he generates all the code himself. This should be ok.
  • 0

#10 Upstream

Upstream

    CC Resident

  • Advanced Member
  • PipPipPipPip
  • 98 posts
  • Location:Netherlands
  • Programming Language:C, C++, PHP, (Visual) Basic, JavaScript, Perl, Bash, Others
  • Learning:Others

Posted 06 September 2012 - 12:24 PM



This will make a copy of sys.php named whatever is sent into the form.

copy('sys.php', $nick . '.php');

It's far from a good thing to do in the long run. The best would be to create a database and store the unique things for each user there.

hmm i am reading this and not sure if Orjan answered your question correctly.. i think your both on different pages.

from what i understand, you simply want to create a page based on whatever the user puts into the text field.

$myFile = "fileName.html";
$fh = fopen($myFile, 'w') or die("can't open file");
$stringData = "<whatever you want inside the html file>";
fwrite($fh, $stringData);

above is code i used to create files yesterday.

if im reading it right, you want it to do this
$myFile = "$nick";
$fh = fopen($myFile, 'w') or die("can't open file");
$stringData = "<?php include ('sys.php');?>";
fwrite($fh, $stringData);


I agree 100% with Orjan. Even when ignoring the downside to programming information statically into your scripts it is very, I repeat very UNSAFE to use file functions! Even more so if you do not know all the ins and outs of it.
This can be exploited in more than one way! It can be used to add, change or del any files on your server possibly making executing of server side code possible or the above can be used to insert malicious javascript to for example steal cookies from your users.


No that isn't possible unless you allow your users to directly give the html code or give full rights on creating files.

I think OP is going to generate a html file. However, the user will be able to name the file whatever and use a GUI to create their own page. As long he dosen't allow them to toss code into those inputs and he generates all the code himself. This should be ok.


When you look at the original code this is a real problem as it takes the form data from the nick and places it directly in the output stream.
$nick=$_POST['nick']; // get the users input
I do not wan't turn it into more then it is but it is not good practice. If I am reading correctly then the suggested solution $myFile = "$nick" is also one to considder twice. Now $nick contains a file handle which is obtained directly from the input form. If you wan't I can give some exampe code which I think will do the trick. Maybe I am mistaken.
  • 0
"The question of whether a computer can think is no more interesting than the question of whether a submarine can swim." (Edsger Dijkstra)

#11 BenW

BenW

    CC Devotee

  • Community Manager
  • 976 posts
  • Programming Language:ActionScript
  • Learning:ActionScript

Posted 06 September 2012 - 05:07 PM

Upstream is correct, you should be extremely careful when allowing users to create pages in that way. Don't assume the user will only enter data that you ask them to. Learn about security and input validation before you make a page like that live to the internet.
  • 1

fss_overall.png

 






Also tagged with one or more of these keywords: help, problem, new, file, fopen

Recommended from our users: Dynamic Network Monitoring from WhatsUp Gold from IPSwitch. Free Download