[RESOLVED] fwrite to config file

[trehy2006]

HI, i have a config file which already has variables set in it. What i want to do is allow a registered user to change these variables

The file (admin.php) contains this where the form is submitted

//Writes the new config file
$file="<?php



//Company Details

$HostingCompany = \"".$HostingCompany."\";

$company_name = \"".$company_name."\";

$CompanyAddress1 = \"".$CompanyAddress1."\";

$CompanyAddress2 = \"".$CompanyAddress2."\";

$CompanyAddress3 = \"".$CompanyAddress3."\";

$CompanyPostCode = \"".$CompanyPostCode."\";

$PayPalAddress = \"".$PayPalAddress."\";


//Parameters

$CurrencySign = \"".$CurrencySign."\";

$CurrencyCode = \"".$CurrencyCode."\";

$DefaultCountry = \"".$DefaultCountry."\";

$DefaultCountryShort = \"".$DefaultCountryShort."\";

$AllowCheques = \"".$AllowCheques."\";



//Details

$urs_con_1 = \"".$_POST['username']."\";

$urs_con_2 = \"".$urs_con_2."\";

$urs_con_3 = \"".$_POST['database']."\";

$urs_con_4 = \"".$_POST['host']."\";

?>";

//saves to the config file
$handle = fopen('configuration.php','w'); 

fwrite ($handle, $file); 

fclose($handle);
print ("<script type=\"text/javascript\">
alert('Settings Saved')
window.location = \"?page=dbconfig\"
</script>");

basically, this writes the config file again. But its writing the values of the variables.
For example the line

$HostingCompany = \"".$HostingCompany."\";

is printing as

yes = "yes";

$HostingCompany is already set to yes in the original (unchanged) config file

whereas i want this to print

$HostingCompany = "yes";

how can i do this, what am i doing wrong?

TIA
Rob

EDIT: Just noticed the forum is removing the \ before the double quotes $HostingCompany ... it is there

[madwormer2]

If you're putting the whole thing in double quotes, you need to escape all $ characters with \

<?php
$file = "\$HostingCompany = \"".$HostingCompany."\";";
?>

Alternatively, you can use single quotes around the whole thing, so that PHP doesn't parse the variables.

<?php
$file = '$HostingCompany = "'.$HostingCompany.'";';
?>

You should validate all the data that you are writing to the file, because if a user is able to change it, it could allow them to run their own code very easily.

[trehy2006]

this bit of code is only to be used by registered admins of the script.

and is all controlled by sessions. So therefore its the admins that would be buggering it, more for me in repairing it!