File get contents php - - need help

[enox10mx]

hello. I have made a small two-page php script on my site. The script is supposed to allow me to create and edit pages on my website, without logging in to cpanel. Here is the code for the folder: File: index.php

<a href="..">home</a>
<br />
<form action="edit.php" method="post">
<h1>type file to edit/make</h1>
<input type="text"name="urltoedit">
<input type="submit" value="edit">
</form>

File: edit.php

<a href="..">Home</a>
<br />
<a href="index.php">Edit/make another page</a>
<br />
<?php
$edit = "edit.php";
$filename = $_post['urltoedit']; // This is what you want to save the file as.
$content = $_post['code']; // This is the stuff that you want to put into the file.
if (empty($content)) {
$html = file_get_contents($filename);    
}
else
{
file_put_contents($filename, $content);
}
?>
<?php
echo "<form method='post' action='edit.php'>";
echo "<textarea name='code' width='500' height='500'>$html</textarea>";
echo "<input type='submit' value='save'>";
echo "</form>";
?>

Whenever I go to index.php and type in a page name, and click my edit button, it returns the following php error:

[B]Warning[/B]:  file_get_contents() [[URL="http://eno.x10.mx/admin/edit.php/function.file-get-contents"]function.file-get-contents[/URL]]: Filename cannot be empty in [B]/****/********/************/*****/********/edit.php[/B] on line [B]10[/B]

(filepath is censored just in case.) Please help me.

 

[descalzo]

Filename cannot be empty --->

file_get_contents($filename); is the problem --->

$filename is the empty string --->

$filename = $_post['urltoedit']; puts the empty string into $filename ---->

$_post['urltoedit'] is the empty string.

Why do you think it has anything in it?

 

[enox10mx]

'cause in the file index.php, I have a form going to edit.php, and the input name on index.php us also urltoedit, and the method is still post.

 

[adam.k]

Are you trying to create a script that can edit non-existent files? If so, that might be why your file_get_contents() is failing.
If you're trying to edit an existing file, try typing an absolute path. Maybe that will work.

 

[descalzo]

Why do you think $_post['urltoedit'] contains the contents of that form field?

PROVE IT TO ME. Cite a source anywhere on the web to support the claim.

 

[adam.k]

Also,

$_post['urltoedit']

should be

$_POST['urltoedit'];

PHP is case-sensitive about these sorts of things

 

[enox10mx]

thanks!

 

[descalzo]

PHP is case-sensitive about these sorts of things

It's usually best to assume that whatever you are doing in programming is case sensitive.

 

[adam.k]

True enough

 

[misson]

It's best to assume whatever would cause the most problems: be consistent in the case you use (so the code will work when case matters) but never define different identifiers that differ only in case (so the code will work when case doesn't matter). This is a consequence of Postel's Law of Robustness.

@enox10mx: as descalzo points out, the form in edit.php doesn't have a "urltoedit" form input, so when you submit the form, it will fail with the same warning, plus a warning that 'urltoedit' is an undefined index. Again, please indent your code for readability. The more readable code is, the more obvious errors are. Also, fix those security holes. Security isn't something you can add in later; you must consider it from day 1, otherwise you'll miss something and your site will get pwnd.