making php file with fopen()

[cgi]

how could i save a php code into a php file with fopen()

for examble i want to save this code into php file


<?php
$a=fopen("one.php","w");
fwrite($a,"any thing");
fclose($a);
?>




:confused:

[morrowasted]

<?
$input_code = "whatever";
$file="file.php";
$write=fopen($file,'w');
fputs($write,$input_code);
fclose($write);
?>

im not php expert, mind you, but i think that works

[CornedBee]

Yep, it works, and you can even include() the file afterwards.

Though eval is probably more efficient in that case.

[morrowasted]

:eek: i made a PHP script that works without any help!!!!

[cgi]

thank's all for your reply's

but

look at this code



<?
$input_code = "
<?
$input_code = "whatever";
$file="file.php";
$write=fopen($file,'w');
fputs($write,$input_code);
fclose($write);
?>
";

$file="file.php";
$write=fopen($file,'w');
fputs($write,$input_code);
fclose($write);
?>



i inserted just a few lines in the $input_code

but what's happened if i inserted a big script in it ??

it will be alot of error's , parse and etc , so is there any way to do it with out error's , some way make the parser get over the inputed code ?? :confused:

[techgnome]

Why are you doing it like that?
If you already have the code, why not jsut put it in a PHP file to begin with?

TG

[CornedBee]

The problem is the matching of quotes. As the syntax highlighter points out, the quotes within your string end your string. You must escape them.

[kows]

For PHP to manually escape characters for you, try addslashes().

To use it with what you are doing, you're going to have to grab the actual code from somewhere, like a POST or GET form.

EG:

$input_code = addslashes($_POST['code']);

Where the user has inputted the code into a text box named "code".

[CornedBee]

Which is about the worst security leak you could ever open.

[phpman]

how is addslashes a security leak?

if you write to a file how is it a security leak? unless of course they stripslahes and inlcude it somewhere

[CornedBee]

The security leak is taking code from the user and executing it as PHP.

[phpman]

yes, I agree, I just read your post a different way.

why would you take code from a user and execute it?

that is almost like saying, here, delete my database. :p

[CornedBee]

Well, combine the results of this thread and you have it.

1)$input_code = addslashes($_POST['code']);
2)$file="file.php";
$write=fopen($file,'wt');
fputs($write,$input_code);
fclose($write);
3) (as according to my first post) include($file);

Happy cracking :)

[The Hobo]

Sounds like fun. I'll try it. :thumb:

[cgi]

thank's all

i found a new code which made the parser getover the code


$link= <<<EOF

$fp = fopen ("file.txt", "w+");
<br/>fwrite ($fp, "Test");
fclose ($fp);

EOF;


i think it's great


The security leak is taking code from the user and executing it as PHP.


thank's for the advice , it's very important

the user's maybe put a dangours code like phpshell code of other

but i will need the way soon

:)