insert php code into file?

[homer09001]

ok im writing a cms system and i have a page that lets you edit the config file problem is it not getting the variable $scmspms from the form?:

the offending line in config_edit.php:

<br> Private Messages Table Name:<br>
<input name='prims' value='$table4' type='text'>(Leave as default (scms_pms) unless you know what you are doing)<br>

config_edit.php3

<?php
session_start();
$id = $_REQUEST['id'];

$scmsserver = $_POST['server'];
$scmsdbname = $_POST['dbname'];
$scmsdbuser = $_POST['dbuser'];
$scmsdbpass = $_POST['dbpass'];
$scmssitename = $_POST['site_name'];
$scmscontent = $_POST['content'];
$scmsmenus = $_POST['menus'];
$scmsusers = $_POST['users'];
$scmspms = $_POST['prims'];
$scmsfolder = $_POST['folder'];
$scmswebaddy = $_POST['webaddy'];

if ($_SESSION['usrlvl'] == 1)
{
echo $scmspms;
$input = '<?php
###############################################
## config.php3                                #
## Author:                  Daniel Hill       #
## Created:                 1/3/06            #
## All code contained is this file is         #
## Copyright Daniel Hill 2006 and must not be #
## edited or redistrubuted without permission #
## from the author                            #
###############################################

$server = "$scmsserver";
$db = "$scmsdbname";
$user = "$scmsdbuser";
$pass = "$scmsdbpass";
$site_name = "$scmssitename";
$table1 = "$scmscontent";
$table2 = "$scmsmenus";
$table3 = "$scmsusers";
$table4 = "$scmspms";
$folder = "$scmsfolder";
$webaddress = "$scmswebaddy";
?>';


//open the file and choose the mode 
$fh = fopen("../config.php3", "w"); 
fwrite($fh, $input); 

//close the file 
fclose($fh); 
echo "$input";
}

else

{

echo "<fnt color='red'><b>Sorry But It Appears That You Are Not Of A User Level With Sufficient Privelidges To Access This Page Or You Aren't Logged In!!</b></font>";

exit();

}

?>

the variable is completely empty

[scrupul0us]

instead of using the < > use the html equivalent

<  = &lt;

= &gt;

you might also want to escape your double quotes within that variable

try that

[homer09001]

scrupul0us wrote:

instead of using the < > use the html equivalent

<  = &lt;

= &gt;

try that

where should i use that?

[tsinka]

Please post more code regarding the form, especially the part where $table4 gets set.

Is the first code block you posted part of an echo statement ?

Besides that: does the second script write e.g. $server = "$scmsserver"; to the file or $server = "<value of $scmsserver>";

I ask this because PHP doesn't expand php variables at all inside single quote strings so I think that you need to use string concatenation in order to add the variable values. to the config file.

Thomas

[homer09001]

yeah im kinda gt my self all tied up and confused now tying to get this towork anyway here the entire form code:

<?php
session_start();
include "../config.php3";
$id = $_REQUEST['id'];

if ($_SESSION['usrlvl'] == 1)
{

echo"
<h2>SimpleCMS General Configuration</h2>
<form method='POST' action='config_edit.php3'>
<br>Database Server Address:<br>
<input name='server' value='$server' type='text'>(If database is on the same server as the site set this to localhost)<br>

<br>Name Of Database:<br>
<input name='dbname' value='$db' type='text'> (Unless you know what you are doing leave this as it is (YourDBPrefix_scms)<br>

<br>Database Username:<br>
<input name='dbuser' value='$user' type='text'> (Leave as it is (YourPrefix_scms)<br>

<br>Database Password:<br>
<input name='dbpass' value='$pass' type='text'><br>

<br>Site Name:<br>
<input name='site_name' value='$site_name' type='text'> This Will Appear In The Site Title<br>

<br>Content Table Name:<br>
<input name='content' value='$table1' type='text'>(Leave as default (scms_content) unless you know what you are doing)<br>

<br> Menus Table Name:<br>
<input name='menus' value='$table2' type='text'>(Leave as default (scms_menus) unless you know what you are doing)<br>

<br> Users Table Name:<br>
<input name='users' value='$table3' type='text'>(Leave as default (scms_users) unless you know 
what you are doing)<br>

<br> Private Messages Table Name:<br>
<input name='prims' value='$table4' type='text'>(Leave as default (scms_pms) unless you know what you are doing)<br>

<br> Folder On Server SimpleCMS Resides In:<br>
<input name='folder' value='$folder' type='text'><br>

<br> http:// Address Of SimpleCMS:<br>
<input name='webaddy' value='$webaddress' type='text'> <br>

<input type='submit' value='Save Changes'>
</form>
";
}

else

{

echo "<fnt color='red'><b>Sorry But It Appears That You Are Not Of A User Level With Sufficient Privelidges To Access This Page Or You Aren't Logged In!!</b></font>";

exit();

}

?>

[homer09001]

Besides that: does the second script write e.g. $server = "$scmsserver"; to the file or $server = "<value of $scmsserver>";

it write like so:

$input = '<?php 
############################################### 
## config.php3                                # 
## Author:                  Daniel Hill       # 
## Created:                 1/3/06            # 
## All code contained is this file is         # 
## Copyright Daniel Hill 2006 and must not be # 
## edited or redistrubuted without permission # 
## from the author                            # 
############################################### 

$server = "$scmsserver"; <--- there you go
$db = "$scmsdbname"; 
$user = "$scmsdbuser"; 
$pass = "$scmsdbpass"; 
$site_name = "$scmssitename"; 
$table1 = "$scmscontent"; 
$table2 = "$scmsmenus"; 
$table3 = "$scmsusers"; 
$table4 = "$scmspms"; 
$folder = "$scmsfolder"; 
$webaddress = "$scmswebaddy"; 
?>'; 

and yes i have noticed that i spelt font wrong 😃

[scrupul0us]

instesad of <?php ... ?>

<?php ... ?>

[homer09001]

ok thats interesting ive got it to write all the variable values just not the variable name:

config.php3

<?php
###############################################
## config.php3                                #
## Author:                  Daniel Hill       #
## Created:                 1/3/06            #
## All code contained is this file is         #
## Copyright Daniel Hill 2006 and must not be #
## edited or redistrubuted without permission #
## from the author                            #
###############################################

 = localhost;
 = homer090_testwcms;
 = homer090_****;
 = ******;
 = simplecms;
 = scms_content;
 = scms_menus;
 = scms_users;
 = scms_pms;
 = SimpleCMS;
 = http://www.global-european.com;
?>

[tsinka]

Replace the $line code with:

$input =<<<EOCONFIG

<?PHP
###############################################
## config.php3                                #
## Author:                  Daniel Hill       #
## Created:                 1/3/06            #
## All code contained is this file is         #
## Copyright Daniel Hill 2006 and must not be #
## edited or redistrubuted without permission #
## from the author                            #
###############################################

\$server = "$scmsserver";
\$db = "$scmsdbname";
\$user = "$scmsdbuser";
\$pass = "$scmsdbpass";
\$site_name = "$scmssitename";
\$table1 = "$scmscontent";
\$table2 = "$scmsmenus";
\$table3 = "$scmsusers";
\$table4 = "$scmspms";
\$folder = "$scmsfolder";
\$webaddress = "$scmswebaddy";
?>

EOCONFIG;

There mustn't be any whitespaces at the end of the lines $input =<<<EOCONFIG and EOCONFIG;

Thomas

[homer09001]

tsinka wrote:

Replace the $line code with:

$input =<<<EOCONFIG

<?PHP
###############################################
## config.php3                                #
## Author:                  Daniel Hill       #
## Created:                 1/3/06            #
## All code contained is this file is         #
## Copyright Daniel Hill 2006 and must not be #
## edited or redistrubuted without permission #
## from the author                            #
###############################################

\$server = "$scmsserver";
\$db = "$scmsdbname";
\$user = "$scmsdbuser";
\$pass = "$scmsdbpass";
\$site_name = "$scmssitename";
\$table1 = "$scmscontent";
\$table2 = "$scmsmenus";
\$table3 = "$scmsusers";
\$table4 = "$scmspms";
\$folder = "$scmsfolder";
\$webaddress = "$scmswebaddy";
?>

EOCONFIG;

There mustn't be any whitespaces at the end of the lines $input =<<<EOCONFIG and EOCONFIG;

Thomas

Parse error: syntax error, unexpected T_SL in /home/homer090/public_html/global-european/SimpleCMS/Admin/config_edit.php3 on line 20

[homer09001]

got it didnt read it probly sorry lol thanks

although i solved it aswell

here my attempt write exactly like yours:

$input = "<?php
###############################################
## config.php3                                #
## Author:                  Daniel Hill       #
## Created:                 1/3/06            #
## All code contained is this file is         #
## Copyright Daniel Hill 2006 and must not be #
## edited or redistrubuted without permission #
## from the author                            #
###############################################
".
'$server' . " = \"$scmsserver\";\n".
'$db' . " = \"$scmsdbname\";\n".
'$user' . " = \"$scmsdbuser\";\n".
'$pass' . " = \"$scmsdbpass\";\n".
'$site_name' . " = \"$scmssitename\";\n".
'$table1' . " = \"$scmscontent\";\n".
'$table2' . " = \"$scmsmenus\";\n".
'$table3' . " = \"$scmsusers\";\n".
'$table4' . " = \"$scmspms\";\n".
'$folder' . " = \"$scmsfolder\";\n".
'$webaddress' . " = \"$scmswebaddy\";\n
?>";

could you explain what that EOCONFIG does? as im trying to teach myself php 😃

[tsinka]

That syntax is called heredoc syntax. Using heredoc syntax you can create large strings without the need to e.g. escape double quotes or to use string concatenation. It's not always useful to use heredoc syntax but in this case it improves readability of the code.
You can use complex variables (like objects) inside a heredoc block (and inside double quote strings, by the way) but you need to enclose them by curly braces.
I had to escape the $ characters at the left side in order to make PHP not to expand the variables (this is the reason why the variable names disappeared in one of the config files you posted).

Thomas

[homer09001]

tsinka wrote:

That syntax is called heredoc syntax. Using heredoc syntax you can create large strings without the need to e.g. escape double quotes or to use string concatenation. It's not always useful to use heredoc syntax but in this case it improves readability of the code.
You can use complex variables (like objects) inside a heredoc block (and inside double quote strings, by the way) but you need to enclose them by curly braces.
I had to escape the $ characters at the left side in order to make PHP not to expand the variables (this is the reason why the variable names disappeared in one of the config files you posted).

Thomas

makes more sens now thanks only 1 problem i just foudn is your code still wouldnt write the complete file iit would stop about 1/2 way through writingthe last variable?

so i ut tried using my ode for a while and it seems to be working but ill kep this post on file for future reference thanks for your help 😃

[FatalError]

Don't use Heredoc or whatever it's called. It's bad programming practice, better to do it the way you have it now.