fwrite and parse error.

spookztar

Hi guys,

I'm doing a setup script for an application and need to produce a DBconnect file dynamically trough PHP, but there's a parseerror "on line 6" (Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING) somewhere within this code:

$filecontent = "<?php
session_start();
define('DATABASENAME', $dbname);
define('HOSTNAME', $dbhost);
If (\$_SESSION['user'] == 666) {
define('DATABASEUSERNAME', $dbusername);
define('DATABASEUSERPASSWORD', $dbpassword);
}
else {
define('DATABASEUSERNAME', 'cm');
define('DATABASEUSERPASSWORD', 'xxxxxxxx');
}
////////////////////////////////////
// DO NOT TOUCH THE CODE BELOW!!! //
////////////////////////////////////
$SQL = $dbconnector = @mysql_connect(HOSTNAME,DATABASEUSERNAME,DATABASEUSERPASSWORD) OR die('<h3 class="warning">Failure: Failed connecting to the database. Verify that the parameters you gave are correct (''), and that the database is running and accessible.</h3>');\n
$dbselector = @mysql_select_db(DATABASENAME) OR die('<h3 class="warning">Failure: Failed selecting your database. Verify that the parameter you gave is correct, and that the database is running and accessible.</h3>');\n
?>";

NogDog

The parse error is caused by this line:

If ($_SESSION['user'] == 666) {n

If you want an array element using a quoted array index to be interpolated as its current value here, then you need to put curly braces around it:

If ({$_SESSION['user']} == 666) {n

If instead you want the string literal "$SESSION['user']" to be saved in the string you are defining, then you need to escape the dollar sign:

If (\$_SESSION['user'] == 666) {n

PS: what are all those "n" characters at the ends of lines?

NogDog

PS: You have some double-quotes further down that need to be escaped. In the two places where you have class="warning" you'll want that to be class=\"warning\" .

bradgrafelman

NogDog wrote:
PS: what are all those "n" characters at the ends of lines?

Editing his post, I can verify that they are actually prepended with a backslash but vbulletin is stripping the slashes for some reason.

@: These "\n" line breaks are unnecessary, however; simply hitting enter to create a new line inside the double-quote string will indeed be written as a linebreak. The "\n" sequences will therefore double the number of line breaks.

spookztar

Thanx guys,

Yes correct, the "n's" are actually line breaks "\n", but if they aren't necessary, I'll omit them.

Escaping the dollarsign in your third example? Your first example (the faulty one) is similar to the third example (the supposedly correct one) you suggest as a possible replacement.

I want the exact, literal string: If ($_SESSION['user'] == 666) { -written to the file, so escaping the dollarsign is the way to go here. Why does this only apply to session variables?

The reason for this way of doing it, is that when an admin whishes to change one or more of the dbconnection parameters from the controlcenter, each line should be an array entry for easy referencing (using file())

One detail: When such a change by the admin occurs, how does it happen physically? Is the whole array rewritten to the file, or only the lines that have been changed? And what would be the name of the array variables? I'm assuming that If you did:

$modify = file(dbconnector.php);

The resulting array would be:

$modify[] = 'first line from file'
$modify[] = 'second line from file'
$modify[] = 'third line from file'

Or what?

NogDog

The escaping of the $ is necessary within a double-quoted string any time you do not want it to be treated as the start of a variable which is to be interpolated. I was assuming (not necessarily correctly) that in the other instances where you have variables in that string you actually wanted them to be replaced by their values.

As an alternative to writing PHP code into files as a way to implement configuration values, I'd recommend thinking about some sort of configuration file that you can read into your script(s), and just modify that config file when customizing the application. I like to use the [man]parse_ini_file/man function for this.

config.ini:

; database connection parameters:
[db_connection]
db_host = localhost
db_user = johndoe
db_password = xxyyzz12
db_name = my_database

PHP script:

$dbValues = parse_ini_string('config.ini') or die("Could not read config file");
$connx = mysql_connect(
   $dbValues['db_host'], 
   $dbValues['db_user'], 
   $dbValues['db_password'
) or die("DB connection error");
mysql_select_db($dbValues['db_name']) or die("Select DB error");
// ...etc....

Then all your installation/configuration script would need to do is create/alter the conig.ini file, not an actual PHP script.

spookztar

Assumption correct.

Ok, I see. I also have a piece of If/else logic I would need to work into it. And also, which way is the more secure? I'm trying to pick up healthy security practices while learning, so I don't get stuck in annoying habits that need to be de-learned further down the road.

It's propably the safest to avoid going through PHP as much as possible :queasy:

Nice tip by the way, thanx.