# Site creation file with PHP

Here is something I've been working on today..

I been trying to determine how to build a website, that has a form, and that form allows a user to make a simple URL to give out. In the future it will also create a website, or possible websites (based off of varying templates that I have built for it).

I just started trying to understand this today, so bear with me...

So far, as far as I am aware, all of the code works and accomplishes the following:

• Allows a user to input a Website name.. I keep both a version with spaces, and a version without spaces.
• It creates a directory for that name with no spaces, and it creates a index.php in that directory.
• It then displays the link to said directory(will not work on this code because I use a generic primary domain name).

Example Test Domain:

www.PrimaryDomain.com/Test/

Example User Input:

$_POST['Dir'] = 'Test User Domain'; <?php //Make sure server is in post mode if($_SERVER['REQUEST_METHOD'] != 'POST')
{
//display form
echo'<form name="" action="" method="post" class="wpcf7-form" >';
echo'<input name="Dir" type="text" placeholder="Username" required autofocus>';
echo'<input type="submit" value="Start" class="wpcf7-form-control wpcf7-submit">';
echo'</form>';
}
else
{
//Specify the URL
$Name = mysql_real_escape_string($_POST['Dir']); //form data
$CurrentDir = getcwd(); //current directory$URL = ''.$CurrentDir.'/'.$Name.'/'; //New url to create

//Speciy the file to create
$Index_file = ''.$URL.'index.php'; //location of new index.php file

//Remove the spaces, and make each it's own variable
$Index_file = str_replace(' ', '',$Index_file); //the location of index.php
$Dir_No_Space = str_replace(' ', '',$URL); //the main directory
$Name_No_Space = str_replace(' ', '',$Name); //the form data the user entered

mkdir('/'.$Dir_No_Space.'', 0777, true); //make the directory$handle = fopen($Index_file, 'w') or die('Cannot open file: '.$Index_file); //Create the index.php File

//Source code of the File: index.php
$index_data = ' <html> <head> </head> <body> <p>This is an example</p> </body> </html> '; fwrite($handle, $index_data); //write the source code to the index.php file //Check the Document Creation if(!fwrite)//if error { echo'Error <br>'; echo mysql_error(); //debugging } else//if not error { //tell the user how to access the new page echo'<p>This is a test in progress for '.$Name.' View @ <a href="http://www.PrimaryDomain.com/Test/'.$Name_No_Space.'/">www.PrimaryDomain.com/Test/'.$Name_No_Space.'/</a>.';
}
}
?>

What do you guys/gals think? Is there a better method for this?

• Is it hidden? Is it safe?
– Mast
Apr 23 '15 at 19:42
• Is what hidden? It seems safe at the moment, the only input I currently take from the user is $Name = mysql_real_escape_string($_POST['Dir']); //form data Apr 23 '15 at 19:44
• @Jason I think the main question is what you want to achieve with this. Who's going to be allowed to access this script? Is there some kind of authentication? Because currently, it's vulnerable to directory traversal and XSS. Once you actually allow input to be written to a PHP file, it will also be vulnerable to code execution. You can defend against the first two attacks, but if you allow users to write directly into PHP files, you need to trust them, there's no way to secure it.
– tim
Apr 23 '15 at 20:18
• @tim I intend on there being an account system associated with this. This particular set of code is on a computer in an internal network that does not host to the interwebs while I write, test, and work on it. SO at the moment only fellow co-workers, and myself have access to it. Only after the site is fully complete will it be released to the gerneral public. Accounts will also need to have a certain level or privilege in order to utilize this particular feature. Apr 23 '15 at 20:30