Alfred,
One point to note is that the file 1.txt must already exist already, because "r+" will not create it if it does not. You should use "a+" or "w+" if you think the file may not already exist. As you will see later, I recommend the latter.
Now I created 1.txt as an empty file and ran this script on a Linux system (getting rid of the "d:\php.doc\" part obviously). The output was as per your prediction, as I would have expected it to be. The only possible explanation I can think of is that 1.txt already exists and has data in it. If that is the case then what is happening is this:
1.txt has contents like this (where * represents an unknown character):
*- cho "Hello!"
*=fopen("d:\php.doc\1.txt", "r+");
Following the script through:
-> The fopen opens the file and places the file pointer at the start of the file. Note that the file is not truncated ... it's contents are left in tact.
-> The first fputs will write "haha" over the first 4 characters in the file.
-> The following fgets will read into $out the rest of the first line of 1.txt, so I predict $out would contain: '- cho "Hello!"'
-> The file pointer is now at the start of the second line of text in the file.
-> Therefore the next fputs will write over the first 4 characters of the second line with "hehe".
-> The second fgets does as per the first and just takes you to the end of that second line.
-> Your fclose finishes off the script and safely releases the file descriptor.
I hope you follow the angle I'm coming from!
All the best,
Louis