fopen() and variable from HTTP link

[Walnut]

 

 

Hi! I’m working with PHP just for fun (not a professional at all), and today I’ve god a real issue with “fopen” function and variables from HTTP link… I just don’t see what’s wrong. Here’s the deal. I kind of try to create something like guestbook for my class project where users can open different files and write in them whatever they want:

 

URL: http://name.of/my/site.php?q=file.txt

<?php
echo "<form>";
$var = $_GET['q']; 
echo "<input type='text' name='message' size=100>";
if (isset($_GET['message']))
      {
      $message = htmlentities($_GET['message']);
      $fp = fopen($var, "a");
      fwrite($fp, "\n$message");
      fclose($fp);
      }
echo "<input type='submit'>";
echo "</form>";
?>

 

The problem is with 3rd and 8th lines of the script… The script doesn’t want to open $var file which is “file.txt”.

However it works fine (as it should) if I forget about variable from HTTP link and write in 3rd line: $var = “file.txt”;

Can anyone help me with that, because I need to use variables from HTTP link?

 

Walnut.

 

[akitchin]

my guess is that when you resend the form with 'message', you're losing the filename value in the URL.  are you sure it's still there when you try to actually write the file?  try adding exit($var); on the line above the fwrite().

[Walnut]

Is there a way to keep $var from the URL from loosing?

[kenrbnsn]

Pass it as a hidden field in the form:

<?php
if (isset($_GET['message']))
      {
      $message = htmlentities($_GET['message']);
      $fp = fopen($var, "a");
      fwrite($fp, "\n$message");
      fclose($fp);
      }
$var = $_GET['q']; 
echo "<form>";
echo "<input type='text' name='message' size=100>";
echo '<input type="hidden" name="q" value="' . $q . '">';
echo "<input type='submit' name="submit">";
echo "</form>";
?>

 

Ken

[Walnut]

$q? did you mean $var?

anyway it doesn't want to open "file.txt" from HTTP variable... now it is gettin anoying, because it is only 12 lines of the simple script...

[kenrbnsn]

Yes I meant "$var". Sorry, I wasn't thinking when I moved some of your code. This should work:

<?php
$var = (isset$_GET['q'])?$_GET['q']:''; 
if (isset($_GET['message']) && $var != '')
      {
      $message = htmlentities($_GET['message']);
      $fp = fopen($var, "a");
      fwrite($fp, "$message\n"); // I like putting the newline after the line is written
      fclose($fp);
      }
echo "<form>";
echo "<input type='text' name='message' size=100>";
echo '<input type="hidden" name="q" value="' . $var . '">';
echo "<input type='submit' name="submit">";
echo "</form>";
?>

 

Ken