PHP mkdir with form input and security - php

Question

I'm trying to make the folder with mkdir but no success, I can see that the path is correct but $_post isn't getting the name of folder from form input ($_post['foldername' is empty) don't know what's the problem. (I have all the permissions to make the folder safe_mode is off

Answer 1

You need to use $_POST to get the filename.
As has been posted in the comments, you also need to do something with $_POST['filename'] to insure that the user is not trying to post a relative path to your script and trying to create folders in locations that you don't intend. At the very least make sure that the variable doesn't contain '..' Since you are prepending a path, I don't think that you have to worry about a direct path to '/' but you may also want to invalidate inputs with a '/' in them.

Answer 2

You could always try this:
<?php
include("models/db-settings.php");
include("models/config.php");
$foldername = $_POST["foldername"];
$filename = $foldername;
$path = __DIR__ . "/uploads/" . $loggedInUser->username;
$fullPath = $path . "/" . $filename;
if (!file_exists($fullPath)){
mkdir($fullPath, 0777);
echo "The directory was successfully created.";
}
echo $fullPath;
?>
<form action="mkdir.php" method="post">
<input type="text" name="foldername" id="foldername" value="FolderName">
<input type="submit" value="submit">
</form>

Answer 3

Change
if (!file_exists($path)) {
mkdir("$path/$filename", 0777);
echo "The directory was successfully created.";
}
to
if (!is_dir($path)) {
mkdir("$path/$filename", 0777);
echo "The directory was successfully created.";
}