fputs adding blank lines

codesters

Here is a snap shot of the code I am having trouble with.

When i write to the file it also includes a space between all the html code. As in code on line 1, blank on line 2, code on Line 3 and so. Since this is a guestbook script and i keep writing to the same file the problem just keeps getting worse until it wipes out the whole file.

The problem I think is fputs because i have tested the $file just before fputs and it seems to be fine.

Any idea anyone?

$DIR = "c:/apache/htdocs/writer/story3/";
$MOTIF = "";

if ($action == write)
{
$GUEST_FILE = $DIR;// . $from;
$GUEST_FILE .= $from;

$date = date("d/m/Y");

$file_arry = file($GUEST_FILE); 

$file = join ("", $file_arry);

$name = htmlspecialchars($Name);
$email = htmlspecialchars($EMail);

$title = htmlspecialchars($Title);
$comment = htmlspecialchars($Comment);

$add = $MOTIF;
$add .= "<table border='0' cellspacing='0' cellpadding='3'><tr><td><A HREF=\"mailto:$email\">$name</A></td></tr><tr><td>Date : $date</td></tr><tr><td>$comment</td></tr></table>";
$file = preg_replace("/$MOTIF/", $add, $file);
$fp = fopen("$GUEST_FILE", "w"); 
flock($fp, 1);
fputs($fp, $file);                                                     
flock($fp, 3);
fclose($fp);

}

Anon

First, it seems that $from is a "untrusted variable" in that it comes from the submission form. If that's the case, this can be used to wipe out any file on the server that the web server daemon has access to.

A (im)properly formed form could (theoretically) let a black hat trash wreak havoc.

Better do a value check on that variable!

Why are you using file to get a line-by-line array of the input, then immediately collapsing it, and then re-writing the whole file?

All we want to do is ADD an entry, try this:

<?
$add="whatever you want it to be";

$fp=fopen($GUEST_FILE, 'a');
fwrite($fp, $add);
fclose($fp);
?>

Much shorter, much quicker and to-the-point.

Also, by using the 'append' operator, you won't trash your guest list should the server get real busy.

codesters

Thanks
The $from variable is hidden. They send the file name in the $from variable so this one script can run a whole site of feed back forms.

It was a guestbook script from www.hotscripts.com and I modified it to work with multiple pages.

Thanks again.

Anon

Well, OK, I'd suggest something like this at the top of your production-ready script:

$ok_froms=array('one', 'two', 'three');
if (!in_array($from, $ok_froms))
die ('Invalid form submission');

That way you close this security hole. Change the value of $ok_froms to reflect the $from values that you find acceptable.

I hope my suggestion of using append rather than write helps...

-Ben