Question

I have a form with an entry textbox that is identified as username.
When the submit button is pressed this code is used:

<?php
if (isset($_POST['submit'])) {
$myUser=$_POST['username'];  
$path="/data/www/vhosts/themacsplash.com/httpdocs/ClipBoy/userfiles/";
$fpath="/data/www/vhosts/themacsplash.com/httpdocs/ClipBoy/userfiles/user.php";
$myFolder = $path . $myUser;
$myFile = $myUser.".php";
$old_umask = umask(0);
mkdir($myFolder, 0777);
$myFileDes = $myFolder."/".$myFile;
copy($fpath, $myFileDes);  
umask($old_mask);
}
?>

This creates a directory and a file, the file is duplicated from user.php In user.php there is this code that needs to be changed upon submit:

$result = mysql_query("SELECT link, notes FROM links WHERE username='will';");

It needs to change where it says username='will';
It needs to change will to the username defined in the form.

How would I do this?

Answer 1

You can get the username dynamically from the directory the file is inside. Use dirname and __FILE__ to get:

$username = dirname(__FILE__);
$username = mysql_real_escape_string($username);
$result = mysql_query("SELECT link, notes FROM links WHERE username='" . $username . "';");

Also i would advise you to filter the input from the user:

$myUser = preg_replace('/[^a-zA-Z0-9_]/', '', $myUser);

This would replace every character that is no alphanumerical character or an underscore by an empty string. Otherwise the user can select "../../../foo/" as username which would probably break the script.