Creating a page

petebolduc

I am attempting to create a page on the server using the following code but the page is not created. I have researched the manual which states that the "w+" will attempt to create the page if it does not exist.

Am I missing something?

<?php

if (isset($_POST["submit"]))
{
$pagename = $HTTP_POST_VARS['pagename'];

$createpage = $HTTP_POST_VARS['page'];

$content=stripslashes($createpage);

$f1 = fopen("../articles/".$pagename, "w+");

fputs($f1, $content);

fclose($f1);

}

?>

Any help would greatly be appreciated.
Pete

Horizon88

If the directory you are in does not have write-permissions for whichever user is running as apache/php then it most likely won't create the files.

petebolduc

Thanks for the response.

What should the permission be?

and.. does the code look right

thanks
pete

Horizon88

../articles/ will need to be writable by the webserver account, whichever user that is. chown apache articles; chmod u+rw articles; might do it, but I'm not sure what your user is set as. Commonly, it's apache, nobody, or www. Offhand, nothing looks wrong with the code, but there could be security vulnerabilities - what happens if I call it with something like "..chr(47)index.php" - would it get evaluated and overwrite your index file? Permissions are a nice feature, but you want to make sure you strip out any malicious inputs, too, just in case. Also, if I call it with a name of a file that already exists, does it get overwritten? Does it matter? Just some thoughts.

petebolduc

I am not sure all what you are asking regarding the user. The host account is cpanel on an apache server. Please expound on how I can identify the user.

I am not sure what chmod u+rw is. I chmod articles to 766 and it did not create the file so I tried it at 777 to see and it still did not create the file.

Also: In the code above I left out the file extension I highlighted how I added it in the code below... is that correct.

<?php

if (isset($_POST["submit"]))
{
$pagename = $HTTP_POST_VARS['pagename'];

$createpage = $HTTP_POST_VARS['page'];

$content=stripslashes($createpage);

[COLOR="RoyalBlue"]$f1 = fopen("../articles/".$pagename.".php", "w+");[/COLOR]

fputs($f1, $content);

fclose($f1);

}

?>

This is the code for the form. Both chunks of code are on - article-test.php which is in a folder on the same level as the "article" folder

<form action="article-test.php" method="POST">
<table class="admin-info">
	<tr>
		<td class="admin-info-left">Page Name</td>
		<td class="admin-info-right"><input type="text" name="pagename" size="40" maxlength="256">
</td>
	</tr>
	<tr>
		<td class="admin-info-left">Content</td>
		<td class="admin-info-right"><textarea name="page" cols="30" rows="5">

</textarea>
</td>
	</tr>
	<tr>
		<td class="admin-info-left"><input type="submit" name="submit" value="Submit">
</td>
		<td class="admin-info-right">&nbsp;</td>
	</tr>	
</table>
</form>

Thanks again for your help
Pete

rikmoncur

this works: (but take into account what Horizon88 says above)


<?php 
//create a page and write to it. prevent overwriting of page if it already exists.

if (isset($_POST["Submit"])) // if it's not set, do nothing.
{
$pagename = $_POST["pagename"].".php"; // the page to be created. Add file extension.

if (file_exists($pagename)) // check if page already exists

{
echo "Page already exists";  // if it exists, tell the user.
}
else // if the page doesn't exist, create it.
		{ 

$pagecontent = stripslashes($_POST["speel"]); // the page content

$f1 = fopen($pagename, "w+"); // create the page (file)

fputs($f1, $pagecontent); // add the content to the page

fclose($f1); // close the page (file)

header("Location: $pagename"); // redirects to new page
		}
}

?>

form:

<form id="form1" name="form1" method="post" action="">
<p>
<input name="pagename" type="text" id="pagename" />
: Page Name </p>
<p>

<input name="speel" type="text" id="speel" />
: Page Content </p>
<p>
<input type="submit" name="Submit" value="Create page" />
</p>
</form>

petebolduc

Thanks to both Horizon88 and Rikmoncur for your assistance.

Rikmoncur's code did work - thanks

I needed it to write to a different directory so I added to the code shown below.

<?php
[COLOR="DarkOrange"]//create a page and write to it. prevent overwriting of page if it already exists.[/COLOR]

if (isset($_POST["Submit"])) [COLOR="DarkOrange"]// if it's not set, do nothing.[/COLOR]
{
$pagename = [COLOR="Red"]"testdir/"[/COLOR].$_POST["pagename"].".php"; [COLOR="DarkOrange"]// the page to be created. Add file extension.[/COLOR]

if (file_exists($pagename)) [COLOR="DarkOrange"]// check if page already exists[/COLOR]

{
echo "Page already exists";  [COLOR="DarkOrange"]// if it exists, tell the user.[/COLOR]
}
else // if the page doesn't exist, create it.
        {

$pagecontent = stripslashes($_POST["speel"]); [COLOR="DarkOrange"]// the page content[/COLOR]

$f1 = fopen($pagename, "w+"); [COLOR="DarkOrange"]// create the page (file)[/COLOR]

fputs($f1, $pagecontent); [COLOR="DarkOrange"]// add the content to the page[/COLOR]

fclose($f1); [COLOR="DarkOrange"]// close the page (file)[/COLOR]

header("Location: $pagename"); [COLOR="DarkOrange"]// redirects to new page[/COLOR]
        }
}

?> 
[COLOR="Blue"]<html>
<body>
<form id="form1" name="form1" method="post" action="test.php">
<p>
<input name="pagename" type="text" id="pagename" />
: Page Name </p>
<p>
<input name="speel" type="text" id="speel" />
: Page Content </p>
<p>
<input type="submit" name="Submit" value="Create page" />
</p>
</form>
</body>
</html>[/COLOR]