PHP File Editor Help

Spixxx

First off, here's my code:

<?php

//Define variables for future use

$filename = $_POST['filename'];
$content = $_POST['content'];
$data = $_POST['data'];
$full_backup = $_POST['full_backup'];
$temp_backup = $_POST['temp_backup'];
$submit1 = $_POST['submit1'];
$submit2 = $_POST['submit2'];

$directory = "backup";

//Define functions

function replaceIn(&$data){
$data = str_replace("?", "[?]", $data);
$data = str_replace("%", "[%]", $data);
$data = str_replace("script", "[script]", $data);
$data = str_replace("form", "[form]", $data);
$data = str_replace("textarea", "[textarea]", $data);
}

function replaceOut(&$content){
$content = str_replace("[?]", "?", $content);
$content = str_replace("[%]", "%", $content);
$content = str_replace("[script]", "script", $content);
$content = str_replace("[form]", "form", $content);
$content = str_replace("[textarea]", "textarea", $content);
}

//If submit wasn't hit, show the form

if(!$submit1)
{
echo "<form action='$PHP_SELF' method='post'>";
echo "Filename: <input type='text' name='filename' size='20' onFocus=\"this.value=''\" value='filename.ext'><br>";
echo "<input type='submit' name='submit1' value='Edit'>";
echo "</form>";
}

//If submit was hit in the above form, process it, and make a new form

if ($submit1 == "Edit"){
if (!file_exists($filename)) { die("\"<b>$filename</b>\" Does Not Exist<br>"); }
$handle = fopen($filename, "r");
$data = fread($handle,filesize($filename));
replaceIn($data);
fclose($handle);
echo "<center><b>$filename</b></center>";
echo "<form action='$PHP_SELF' method='post'>";
echo "<textarea name='content' cols='50' rows='20'>";
echo "$data";
echo "</textarea><br>";
echo "<fieldset style='padding: 3px'>";
echo "<legend>Options</legend>";
echo "<br>";
echo "Backing up your files will allow you to easily retrieve the old file in case of any errors or mistakes.<br>";
echo "Full Backup will copy the old file to the $directory directory. Temporary Backup will create a textarea of the old data on the next screen.<br><br>";
echo "Full Backup&nbsp;";
echo "<select size='1' name='full_backup'>";
echo "<option selected>No</option>";
echo "<option>Yes</option>";
echo "</select>";
echo "<br>";
echo "Temporary Backup&nbsp;";
echo "<select size='1' name='temp_backup'>";
echo "<option selected>Yes</option>";
echo "<option>No</option>";
echo "</select>";
echo "</fieldset>";
echo "<br>";
echo "<input type='hidden' name='filename' value='$filename'>";
echo "<input type='hidden' name='data' value='$data'>";
echo "<input type='submit' name='submit2' value='Save'>";
echo "</form>";
}

//If submit was hit in the above form, process it

if ($submit2 == "Save"){

if($temp_backup == "Yes"){
echo "<center>";
echo "Here is your temporary backup of \"<b>$filename</b>\":<br>";
echo "<textarea>";
echo "$data";
echo "</textarea>";
echo "</center>";
echo "<br>";
}

if($full_backup == "Yes"){
if(!is_dir($directory)){
mkdir("$dirname", 0755);}
$handle = fopen("$directory/$filename", 'w+');
fwrite($handle, $data);
fclose($handle);
echo "<a href='$directory/$filename' target='_blank'>\"<b>$filename</b>\"</a> Backed Up<br>";
}

$content = stripslashes($content);
replaceOut($content);
$handle = fopen($filename, 'w+');
fwrite($handle, $content);
fclose($handle);
echo "<a href='$filename' target='_blank'>\"<b>$filename</b>\"</a> Updated<br>";
}

?>

Everything works its just that when I edit the file in the second page, the...

echo "<input type='hidden' name='data' value='$data'>";

...messes up the second page and displays random input buttons, text, etc

What other way can I do this while still preserving the orginal $data before replaceIn() and use the old $data for the next page?

sfullman

echo "<input type='hidden' name='data' value='".htmlentities($data)."'>";

that should do it; in theory you could have an entire HTML page in data, and it wouldn't affect your code. Check it out in the manual.

you might consider doing:

echo "code
over
multiple
lines
is
OK";

versus

echo "code ";
echo "over ";
echo "multiple ";
etc.

-- less filesize and processing time

BTW you should get in the habit of using ' vs. " for quotations wherever possible as PHP processes them faster (in a single quote, most everything is literal and vars arent' read.

so instead of:

$data = str_replace("?", "[?]", $data);
$data = str_replace("%", "[%]", $data);
$data = str_replace("script", "[script]", $data);
$data = str_replace("form", "[form]", $data);
$data = str_replace("textarea", "[textarea]", $data);

use:

$data = str_replace('?', '[?]', $data);
$data = str_replace('%', '[%]', $data);
$data = str_replace('script', '[script]', $data);
$data = str_replace('form', '[form]', $data);
$data = str_replace('textarea', '[textarea]', $data);

Sam

Weedpacket

You might also want to store that stuff in session variables instead of a hidden form field: saves having to encode it, shovel it all out to the browser, and hope that it makes it back again in one piece.

sfullman wrote:
BTW you should get in the habit of using ' vs. " for quotations wherever possible as PHP processes them faster (in a single quote, most everything is literal and vars arent' read.

This is only true if you have variables embedded in the double-quoted string. But if you're embedding variables, you wouldn't be using single-quoted strings anyway. Since "[?]" doesn't contain any embedded variables, changing it to '[?]' doesn't make anything happen any faster.