Is the following code below possible? Or no because its a security issue? I'd like to fwrite across from one folder to another so if the fwrite function is located at /1, can I fwrite to a .txt file on /2?
<?php
$myFile = "../news/derp.txt";
$fh = fopen('derp.txt', 'w') or die("File Can't Be Written To.");
$stringData = "Yo, .";
fwrite($fh, $stringData);
fclose($fh);
?>
As long as the script is being executed in a context where it has write permissions to the file, it should work.
The security issue question requires more information about what you are doing with it and whether or not the second directory is publicly visible.
A remote file would most likely not be writeable by PHP, but if it's a local folder, it just depends on whether PHP has write access to that folder + file.
Read this:
"If PHP has decided that filename specifies a local file, then it will try to open a stream on that file. The file must be accessible to PHP, so you need to ensure that the file access permissions allow this access. If you have enabled safe mode, or open_basedir further restrictions may apply."
http://php.net/manual/en/function.fopen.php
PHP can write to anywhere on your filesystem. PHP is not limited to the domain of the server running it, which is why LFIs are so efficient.
PHP can write to any directory it has write access to. If you don't have access to it, like if it's someone else's account on a shared server, then no you probably won't be able to do that.
The answer to my question is yes. I was just unaware of the circumstances, and the correct way to ascend to the file. Here is the final working script.
Writing from /1/fwrite.php, here's the script.
<?php
$file = fopen("../2/derp.txt","w");
fwrite($file,"Hello World!");
fclose($file);
?>
Related
I trying to create new file in Ubuntu system using PHP script,
but when I run this script the error
Unable to Open file
is appear
although I sure that the file's path is right and I have permissions to access this file I don't know where is the wrong
this is my code
$myfile = fopen('inc/users/future.php', "w")or die("Unable to open file!") ;
$text='<?
$host ="'.$host.'";
$user ="'.$db_admin.'" ;
$pass ="'.$db_password.'";
$db ="'.$database.'" ;
$myconn;?>';fwrite($myfile, $text);
fclose($myfile);
the path of this script is
/var/www/html/ghost/index.php
and the path of the file which I wish to open is
/var/www/html/ghost/inc/users/future.php
in other hand when I run this script in windows machine every thing is go fine
In your script use
fopen(dirname(__FILE__) . '/inc/users/future.php', 'w')
This will create a filepath from the directory your index.php. If you script is called from another file, php might search coming from that file.
Also check if the php process has sufficient file permissions to read and open the file. Try setting the file to chmod 777 just to test if that is the case (do not leave it on 777 though).
Keep in mind that if the file is a symbolic link, the 'w' parameter of fopen will not work.
I am using XAMPP Virtual Server. In my PHP code, I create a word document and write to it. The document is saved in the same directory of the php file. Now, after I've written to this document, I want it to automatically open, so that the user can view it. Is that possible in PHP? If so, then How? Below is the part that opens the file and writes to it. I am missing the file view part. Thank you.
$fp = fopen( $fileName, 'w+');
fwrite($fp, $report);
Note: I don't want to download the file. (Consider that the server and the client is the same machine). I just want the file to open.
Have you tried: header("location: file:///C:\xampp\public_html\docs\worddocument.doc");
Wow, didn't ever done this, but it worked:
`notepad c:/xampp/htdocs/bitnami.css`;
This is for the case that you want that PHP opens others apps. Be aware of the execution time limit of the PHP.
I have a file sort of like this, it's a user database (udb.htm):
user1:pwd1
user2:pwd2
user3:pwd3
something along the lines of that. I would like to secure this file and make it available for PHP via the file_get_contents("udb.htm"); method, but not a browser window. Thanks!
you can:
upload the file in a directory outside the public html directory, but that php has access
block the access to the file using apache .htaccess <Files> or similar
use HTTP Basic Authentication
save your data in an actual database (mysql, mssql, oracle, sqlite)
Put the file outside of the web root. For instance, in the directory that contains public_html. PHP can access it (and any other file on the system), but you can't get to it from the web.
Move the file into a folder still accesible to PHP but not web clients.
What you want to do is put the database below the web path. So for example, if your website is at www.example.com and it points to: /var/www/html
Then you can put your password file into /var/www/password/udb.htm
Then access it from your php script as file_get_contents("../../password/udb.htm")
Your script can access the file, but your web service will not.
This changes the permissions of your file before open, and remove grants when you close the file, be sure about webserver permissions over the file.
<?php
$file = 'udb.htm';
chmod($file, 0600);
$contents = file_get_contents($file);
chmod($file, 0000);
?>
I'm trying to load data from a CSV on my Windows PC into a database, something I've successfully done previously. fopen can't find my input file.
Here's the specific code I'm having trouble with:
<?php
ini_set('track_errors', '1');
$handle = fopen("C:/Users/Sam/Documents/test.csv", 'r') or die("can't open file: $php_errormsg");
?>
The error printed is:
[function.fopen]: failed to open stream: No such file or directory
The file definitely exists, and I get the same problem on Unix machines. How do I fix this?
Windows 7 (and Vista?) only lets a user access his own home directory and does not allow Apache (or other users) to. Unfortunately, this is a major headache, and I would suggest that you just move the file somewhere public.
This type of behavior is easier to fix in Linux, but you're still better off moving the file out of your directory into some path where Apache has read access.
This code below is using the FWRITE function. however i wish to save the file to a specific location but always get 'cant open file' as expected. i have setup the directory listed in mypath but it still wont write to that location.
$mypath = "http://www.mysite.com/test/data/";
$myFile = $mypath."data.txt";
$fh = fopen($myFile, 'w') or die("can't open file");
$stringData = "Some text";
fwrite($fh, $stringData);
fclose($fh);
The HTTP wrapper does not support writing. If mysite.com is the same server you're running on, and that's a physical directory, you would use a regular file path (no HTTP). What filename that URL corresponds to depends entirely on how your server is set up.
If it's a different machine, you need to use curl or another solution to do a PUT or POST.
Try using a logical path to save the file such as:
/home/mysitefolder/public_html/test/data/
also check to make sure that PHP is running as Apache and has permissions to write to that folder.
Your path is wrong; you can't use http:// as a path, you need something like /var/www/test/data as $mypath.