Adding a string to an existing URL text file

I want to add a string to an existing URL text file. I know I could GET the file from the URL, temporarily write it to the local HDD, add my string, then PUT the file back on the site, then finally delete the local temp file. However, I really want to avoid the step of having the file temporarily on the user HDD. Is there a way to just add a string to the bottom of an existing file on a web site?

What I am wanting to create is when the users register their program via the web , we capture the info (just a serial number, the date and time) to an existing file. I can then check and clear this file periodically from our site to know who has registered.

I can think of a number of things wrong with that from a security perspective.

but what may solve many of the issues, is make the app upload a standalone file with the required info, into a special directory. Then periodically run a job on the server-side to combine any single files and add them to your master list that is NOT in a public directory.
For this, PUTting the file up to the server is somewhat straightforward.

you can read the file directly into memory, but you still need to write the file to upload back to the server

this is really a job for server side scripting, php or cgi, then submit a virtual webform

Or if the folder on the server is WebDAV-enabled you can write back to it that way, often using a simple PUT.

That still leaves the security issue however. You don't want people uploading junk at random.

The only uploading will be hard coded in the program so there won't be the ability to upload junk. However, I would prefer not to have to temporarily write a file with others registration numbers (no customer ID or info) just as a precaution. That is why I am looking for something like the VB Open as Append concept but to the file already on the web site.

Writing a file with a single registration number, into a temp dir is MUCH more secure than writing to the file that contains everybodies numbers. It is pretty simple (if somebody was inclined) to find out where your program is sending the info, and if it is public enough for your app to write to the file, then it is public enough for the evildoer to take the whole file and all the numbers in it.

A temp folder ensures that even if they can get at the whole folder, they only get a handful of codes, at most. Additional layers on that could include creating a new temp dir for each registration, random GUIDs as the filenames, etc...

Another upside of running a job to move the temp codes to the master is that you can then validate them. no matter how you choose to upload, it can easily be discovered, copied, and evil Eddie can upload all sorts of invalid data and nasty code to try and catch you with an in-line attack.

You want to store something on the web and update it remotely? You have to realize there is a whole new world of design and programming involved.

....of course this all assumes you're worried about this sort of thing. If you think the risk is incredibly low, then it may not be worth the bother ;)

Good food for thought. I think I need to sleep on concepts for awhile. Thanks.

It is possible to have a folder protected by a guest user/pw you hard-code encrypted into your program. As always these things are hard to protect, but it is better than having a folder anyone in the world can write to without having even those credentials.

WebDAV allows you to append to files on the server or even treat files as random access.

I don't know of any free VB6 WebDAV components and Microsoft broke ADO's WebDAV capabilities recently, so you'd have to roll your own code. The only other WebDAV support Microsoft exposes for general use by a program involves mapping a drive letter to the Web share.

If you are using this for program registration wouldn't it make more sense to use a DB?

No on the database as we keep that internally on our local pc. What I am doing is adding ability for customer to get their annual activation via the web 24/7 as apposed to having to call us during business hours and manually keying it in. But after they get their web activation, I want to know who has done it via web which I can tell from a customer unique code that is part of their registration. I can then daily or when ever get the file of web registrations and mark our local pc customer db. I would then purge the web file after I update our customer db. I'm not sure the security thing is a real issue as even if someone got the list of codes from the web file it would be of little use unless they broke our code for the registration codes and that really has no actual customer info.