[SOLVED] Substituting variable for filename

[heckler0077]

Hello. I am trying to create a script that presents you with a textbox where you enter the name of a .zip, .tgz, or .tar.gz file in that directory on your server. Then, it decompresses it one the server. Here is the script:

 

<?php 
$filename = $_GET['filename']; 
if (empty($filename)) 
{ 
?> 
<form action="" method="GET"> 
<input type="text" name="filename"> 
<input type="submit"> 
</form> 
<?php 
} 

else 
{ 
if (strpos($filename,".zip") >= 1) 
{ 
exec('unzip $filename',$ret); 
echo "Successful unzipping"; 
} 
elseif ((strpos($filename,".tgz") >= 1) || (strpos($filename,".tar.gz") >= 1)) 
{ 
exec('tar -xzf $filename',$ret); 
echo "Successful untargzing"; 
} 
else 
{ 
?> 
<form action="" method="GET"> 
<input type="text" name="filename"> 
<input type="submit"> 
</form> 
<?php 
} 
} 
?>

 

On the two exec lines, if I replace $filename with the actual name of a compressed file on my server, it will successfully decompress it, but if I leave it the way it is and enter that file's name in the textbox, it will not work. Why isn't it decompressing?

[MadTechie]

In unzip a valid program command on your server ?

is exec allowed ?

any errors ?

[heckler0077]

Everything is installed and allowed.  I get no errors.  If, instead, of putting the name of a variable, I actually put the compressed file's name, it correctly unzips it.

[MadTechie]

change

<?php
exec('unzip $filename',$ret); 
?>

 

to

<?php
exec("unzip $filename",$ret); 
?>

 

 

(Note ' to ")

 

you can't parse a variable in single quotes