PHP fwrite() with executed and none executed variables

Dev Shed Forums Sponsor:

November 3rd, 2009, 04:45 AM

phpwebmaster

Contributing Badly User

Join Date: Mar 2007

Posts: 122

Time spent in forums: 1 Day 14 h 14 m 37 sec
Reputation Power: 5

PHP fwrite() with executed and none executed variables

PHP Code:


		
			
 $file = "config_test.php";

        $towrite = '<?php $dbhost = "$host" ; ?>';

        $openedfile = fopen($file, "w+");

            fwrite($openedfile, $towrite);

               fclose($openedfile);

Well as you can see this is really simple code its almost doing what i want.

Basically everything between the single quotes in the second line $towrite does write into the specified file and all works.

What im having problems with is getting the $host variable to execute as a variable and not text what i want it to do is write something like this into the file

Code:

<?php $dbhost = "hostname" ; ?>

but its writing this

Code:

<?php $dbhost = "$host" ; ?>

I have tried all sorts of variations of double quoted and single quotes with and without periods around the variable $host but i just cant seem to get it to execute how i want, the only time it did execute was when i enclosed it all in doublequotes, but as would be expected this executed both variables and i dont want the first variable to execute.

Any clues?

Please excuse my edit.. mr fat fingers decided to pay me a visit ;op

SOLVED:: May not be pretty but it works..

PHP Code:


		
			
 $file = "config_test.php";

        $towrite = "<?php ".'$dbhost'." = \"".$host."\"; ?>";

        $openedfile = fopen($file, "w+");

            fwrite($openedfile, $towrite);

               fclose($openedfile);

__________________
If i went into too much detail or assumed this was what you meant, well thats just how i thought you wanted it

Last edited by phpwebmaster : November 3rd, 2009 at 05:28 AM.

November 3rd, 2009, 06:16 AM

Northie

Square Peg in a Round Hole

Join Date: Oct 2007

Location: North Yorkshire, UK

Posts: 641

Time spent in forums: 4 Days 21 h 10 m 46 sec
Reputation Power: 320

Does this not give you what you want?

PHP Code:


		
			
 $file = "config_test.php";

        $towrite = '<?php $dbhost = "'.$host.'" ; ?>';

        $openedfile = fopen($file, "w+");

            fwrite($openedfile, $towrite);

               fclose($openedfile);

November 3rd, 2009, 08:46 AM

phpwebmaster

Contributing Badly User

Join Date: Mar 2007

Posts: 122

Time spent in forums: 1 Day 14 h 14 m 37 sec
Reputation Power: 5

Quote:

Originally Posted by Northie

Does this not give you what you want?

PHP Code:


		
			
 $towrite = '<?php $dbhost = "'.$host.'" ; ?>';

no it doesn't, im using this to set up a variable as part of an install script im setting up.

it needs to write this to the file:

<?php $dbhost = "localhost" ; ?>

Basically write the first variable without executing it and then execute the second variable, i struggled to get the double quotes and execute the variable all at the same time, after dome thought and a lot of fiddling i figured on using double quotes but then stopping the first variable from executing by single quoting. it, like i say it dont look pretty but its working.

where i think your code would write:
<?php $dbhost = localhost ; ?>

This would probably be fine except for the password part where cpanels pass generator uses characterd that unquoted would break the code.

November 3rd, 2009, 08:49 AM

Northie

Square Peg in a Round Hole

Join Date: Oct 2007

Location: North Yorkshire, UK

Posts: 641

Time spent in forums: 4 Days 21 h 10 m 46 sec
Reputation Power: 320

This

PHP Code:


		
			
 $host = 'localhost';

$towrite = '<?php $dbhost = "'.$host.'" ; ?>';

echo $towrite;

Outputs

Code:

<?php $dbhost = "localhost" ; ?>

This

PHP Code:


		
			
 $host = 'localhost';

$towrite = "<?php $dbhost = '".$host."' ; ?>";

echo $towrite;

Outputs

Code:

<?php $dbhost = 'localhost' ; ?>

This

PHP Code:


		
			
 $host = 'localhost';

$towrite = "<?php $dbhost = '$host' ; ?>";

echo $towrite;

Ouputs this

Code:

<?php $dbhost = 'localhost' ; ?>

This

PHP Code:


		
			
 $host = 'localhost';

$towrite = "<?php $dbhost = \"$host\" ; ?>";

echo $towrite;

Ouputs this

Code:

<?php $dbhost = "localhost" ; ?>

This

PHP Code:


		
			
 $host = 'localhost';

$towrite = "<?php $dbhost = \"".$host."\" ; ?>";

echo $towrite;

Ouputs this

Code:

<?php $dbhost = "localhost" ; ?>

is this not what you want?

Last edited by Northie : November 3rd, 2009 at 08:53 AM.

November 3rd, 2009, 08:57 AM

Northie

Square Peg in a Round Hole

Join Date: Oct 2007

Location: North Yorkshire, UK

Posts: 641

Time spent in forums: 4 Days 21 h 10 m 46 sec
Reputation Power: 320

Out of interest, why are you doing this?

I hope you're not going to be eval()ing it at any point

This all looks very insecure.....

November 3rd, 2009, 09:25 AM

IkoTikashi

Contributing User

Join Date: Sep 2003

Location: Germany

Posts: 1,260

Time spent in forums: 1 Week 2 Days 11 h 32 m 2 sec
Reputation Power: 275

Quote:

where i think your code would write:
<?php $dbhost = localhost ; ?>

Do you think or did you try it?

PHP Code:


		
			
 $towrite = '<?php $dbhost = "'.$host.'" ; ?>';

will print out

PHP Code:


		
			
<?php $dbhost = "localhost" ; ?>

or whatever you set $host to (if you echo $towrite, that is)

__________________
IkoTikashi - ikotikashi.de

November 3rd, 2009, 10:38 AM

phpwebmaster

Contributing Badly User

Join Date: Mar 2007

Posts: 122

Time spent in forums: 1 Day 14 h 14 m 37 sec
Reputation Power: 5

Quote:

Originally Posted by IkoTikashi

Do you think or did you try it?

PHP Code:


		
			
 $towrite = '<?php $dbhost = "'.$host.'" ; ?>';

will print out

PHP Code:


		
			
<?php $dbhost = "localhost" ; ?>

or whatever you set $host to (if you echo $towrite, that is)

i was just thinking i didnt try it as id already resolved it in my own way, i will try it out anyway as its only a small change to what i have and its easier to read and understand,

$host is going to be set by the user installing the script, its not much really but i wanted to make the install easier. uploading the database, creating configurations file with settings and that sort of thing. so far its going well, its taken me all day to work it all out but im happy with the results. (so far) lol

November 3rd, 2009, 10:46 AM

phpwebmaster

Contributing Badly User

Join Date: Mar 2007

Posts: 122

Time spent in forums: 1 Day 14 h 14 m 37 sec
Reputation Power: 5

Quote:

Originally Posted by Northie

Out of interest, why are you doing this?

I hope you're not going to be eval()ing it at any point

This all looks very insecure.....

You have a point with it lookin insecure, at the moment it is, i have only been testing it in an unlinked directory as i wanted to get it working.

its taking information from a form, using that info to create a database with pre compiled queries, and write the configuration file for the site.

The database information is stored in a config file outside of the web path once its written to the file and the database has installed the installation directory is to be deleted. either by way of a link in the installation or manually, ive yet top look into all that.

As for security script wise, i know i have a long way to go before this could even possibly be thought about using properly, but in testing its working fine, obviously im not trying to attack my server tho lol

November 3rd, 2009, 10:50 AM

ManiacDan

User, Contributing

Join Date: Oct 2006

Location: Texas, USA

Posts: 3,849

Time spent in forums: 1 Month 1 Day 15 h 2 m 21 sec
Reputation Power: 1712

Just as an aside, this is what you were looking for:

PHP Code:


		
			
 $file = "config_test.php";

$towrite = "<?php \$dbhost = '$host'; ?>";

$openedfile = fopen($file, "w+");

fwrite($openedfile, $towrite);

fclose($openedfile);

You need to escape the dollar sign in $dbhost so it gets printed literally, instead of as a variable. Then you need single-quotes around $host in case it contains characters that may be interpreted when you pull the data back in.

This is also the wrong way to do things, you should be using an ini-file format (see parse_ini_file) or a database.

-Dan

__________________
"They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin

"The greatest tragedy of this changing society is that people who never knew what it was like before will simply assume that this is the way things are supposed to be." -2600 Magazine, Fall 2002

Think we're being rude? Please read this. Trying to argue intelligently? Please read this.

#10

November 3rd, 2009, 11:00 AM

phpwebmaster

Contributing Badly User

Join Date: Mar 2007

Posts: 122

Time spent in forums: 1 Day 14 h 14 m 37 sec
Reputation Power: 5

Quote:

Originally Posted by ManiacDan

Just as an aside, this is what you were looking for:
[PHP]
This is also the wrong way to do things, you should be using an ini-file format (see parse_ini_file) or a database.

-Dan

Thanks dan, the ini-file doesnt appear at least on the surface to be what im looking for. If im getting what its for correct, i know the php ini can contain mysql connection information, tho the last time i installed php it was advised against doing so.

im not trying to make a 1 system program i wouldnt bother wasting my time doin all this work for just 1 install, this is mean to be a reusable installation across different sites, even servers if need be

#11

November 3rd, 2009, 11:04 AM

IkoTikashi

Contributing User

Join Date: Sep 2003

Location: Germany

Posts: 1,260

Time spent in forums: 1 Week 2 Days 11 h 32 m 2 sec
Reputation Power: 275

Not php.ini, but a "general" .ini file for configuring your site, like config.ini, database.ini etc.

Comments on this post

ManiacDan agrees: Yes, that.

Thread Tools	Search this Thread
Email this Page	Search this Thread: Advanced Search
Display Modes	Rate This Thread
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode	Rate This Thread: