note 80184 added to function.file-put-contents

I use the following code to create a rudimentary text editor. It's not fancy, but then it doesn't have to be. You could easily add a parameter to specify a file to edit; I have not done so to avoid the potential security headaches. There are still obvious security holes here, but for most applications it should be reasonably safe if implemented for brief periods in a counterintuitive spot. (Nobody says you have to make a PHP file for that purpose; you can tack it on anywhere, so long as it is at the beginning of a file.) <?php $random1 = 'randomly_generated_string'; $random2 = 'another_randomly_generated_string'; $target_file = 'file_to_edit.php'; $this_file = 'the_current_file.php'; if ($_REQUEST[$random1] === $random2) { if (isset($_POST['content'])) file_put_contents($target_file, get_magic_quotes_qpc() ? stripslashes($_POST['content']) : $_POST['content']); die('<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>Editing...</title> </head> <body> <form method="post" action="' . $this_file . '" /> <input type="hidden" name="' . $random1 . '" value="' . $random2 . '" /> <textarea name="content" rows="50" cols="100">' . file_get_contents($target_file) . '</textarea><br /> <input type="submit" value="Save Changes" /> </form> </body> </html>'); } ?> Then simply browse to hxxp://www.example.com/{$this_file}?{$random1}={$random2}, with the appropriate values substituted for each bracketed variable. Please note that this code assumes the target file to be world writable (-rw-rw-rw- or 666) and will fail to save properly without error if it is not. Once again, this is by no means secure or permanent, but as a quick fix for brief edits to noncritical files it should be sufficient, and its small size is a definite bonus. ---- Server IP: 216.235.15.211 Probable Submitter: 75.152.237.160 ---- Manual Page -- http://www.php.net/manual/en/function.file-put-contents.php Edit -- https://master.php.net/note/edit/80184 Del: integrated -- https://master.php.net/note/delete/80184/integrated Del: useless -- https://master.php.net/note/delete/80184/useless Del: bad code -- https://master.php.net/note/delete/80184/bad+code Del: spam -- https://master.php.net/note/delete/80184/spam Del: non-english -- https://master.php.net/note/delete/80184/non-english Del: in docs -- https://master.php.net/note/delete/80184/in+docs Del: other reasons-- https://master.php.net/note/delete/80184 Reject -- https://master.php.net/note/reject/80184 Search -- https://master.php.net/manage/user-notes.php