fopen $_SERVER[REQUEST_URI]

Question

I need to fopen a file with the same name as the url with '.txt' at the end.

I have this: fopen("$_SERVER[REQUEST_URI].txt", 'a+')

but I think the forward slash at the beginning of the url is messing things up.

Answer 1

You should probably trim the URI, however this looks ... highly insecure.

$filename = trim($_SERVER['REQUEST_URI'], "/");
$filename .= ".txt";

$handle = fopen($filename, "a+");

To clarify why this is insecure, people could use this to access, potentially, any file in that directory.

You should probably have an array of "allowed files" that people may access, and then check to see if the given file is in that array. For example:

$allowed_files = array(
    "file1.txt",
    "file2.txt",
);

$filename = trim($_SERVER['REQUEST_URI'], "/");
$filename .= ".txt";

if(in_array($filename, $allowed_files)){
    //Success, so they may view the file
    $handle = fopen($filename, "a+");
}else{
    //Failure, they may not
    return false;
}

To keep it generic, try this:

//Validate the filename
$filename = $_SERVER["REQUEST_URI"];
$slashes = explode("/", $filename);
$filename = $slashes[1];
$filename .= ".txt";

$handle = fopen($filename, "a+");

Answer 2

Maybe you want to use the __FILE__ constant:

$fp = fopen(preg_replace('/\..+$/', '.txt', __FILE__), 'a+');

Of course, your code would have to be on the correct page.