Please help me with a little PHP thingy ;.;

Arboration · 09-02-2002 6:36pm #1

Ever been to one of those sites, where it has a php index page ?
And the main new's part of the page is uploaded through a txt file?

You know, instead of the webmaster having to open a HTML editor just to change the news ?

He just changes the TXT file, upload's it, BAM! Its updated?

How'dy'do tha'?

dahamsta · 09-02-2002 7:13pm

A simple example:

[php]<?php

// Grab the contents of the requested file.
// file() creates an array of the file contents, one element per line.
// implode() creates a string out of the array.

$content = implode('', file($file));

// "Here print" the rest of the document, or alternatively,
// you can pop out of parsed mode and use an inline echo.

echo <<<EOD

<html>
<head>
<title>Title</title>
</head>
<body bgcolor="white">
<h1>Title</h1>
$content
</body>
</html>

EOD;
?>[/php]Now you would just pass the filename to the script, and voila, there's your page. This is a simple, insecure example though, wide open to directory tranversal. Say for example that a user called a URL like this:

http://yoursite.com/path/to/script/?file=/etc/passwd

Now he has the contents of your passwd file, which he can run a brute force attack on in his own time, and possibly get root on your machine.

You get around this by a) removing the file extension, and appending it in the script; and b) making sure he doesn't include directory information. Use the str() and ereg() functions to parse out user input.

adam

Arboration · 09-02-2002 7:34pm

[php]<?php

// Grab the contents of the requested file.
// file() creates an array of the file contents, one element per line.
// implode() creates a string out of the array.

$content = implode('News', file($News.txt));

// "Here print" the rest of the document, or alternatively,
// you can pop out of parsed mode and use an inline echo.

echo <<<EOD

<html>
<head>
<title>Title</title>
</head>
<body bgcolor="white">
<h1>Title</h1>

$content

</body>
</html>

EOD;
?>
[/php]

So, thats how it is ?

Let's say, If I add HTML into my txt file ?
Will it be shown as HTML?

dahamsta · 09-02-2002 7:53pm

This is wrong:

[php]$content = implode('News', file($News.txt));[/php]

The first argument to implode() is the delimiter, i.e. the string (glue) that will be placed between each array element when the string is created. In other words, $content will end up looking like:

Line
NewsLine
NewsLine
etc.

Leave the first argument empty. Also, as I said, you should parse the user input for security first. Something like:

[php]if ( strstr('/') || strstr('.') ) {
echo "Illegal input, chancer!";
}[/php]

Have a look at the function docs:

http://uk.php.net/explode
http://uk.php.net/file
http://uk.php.net/strstr

Let's say, If I add HTML into my txt file ? Will it be shown as HTML?

Yes.

adam

Ph3n0m · 11-02-2002 1:53pm

why not use a simple include

<html>
<head>
<title>Untitled</title>
</head>

<body>
<?php

include("/content.txt");

?>

</body>
</html>

Arboration · 12-02-2002 3:25am

Warning: Failed opening '/Content.txt' for inclusion (include_path='') in /usr/home/ffrapture/index.php on line 86

Index.php

Content.txt CHMOD: 777

what went wrong

Ph3n0m · 12-02-2002 11:25am

d'oh (my mistake)

make sure the text file is in the same directory as the index.php

and the include statement should look like this

<?
include ("content.txt");

?>

much better

The Corinthian · 12-02-2002 12:23pm

In all these cases here, all you’re going to include in your PHP script is raw, unformatted text. You'll still need to format your content. A very common approach is to use template includes at the top and bottom of your pages:
[PHP]
require("top.php");
<p>HTML forrmatted body text goes here...</p>
require("bottom.php");
[/PHP]
top.php would generally contain all the repetitve HTML <HEAD> content and CSS data, up to around the <BODY> tag. bottom.php could often just be the </BODY></HTML> tags (and any repetitive content, such as copyright notices, that would need to appear on all your pages).

If you look at the source code here you'll see HTML comments denoting where the relevant TOP and Bottom templates end/begin.

Please help me with a little PHP thingy ;.;

Comments