Member Avatar for david cashin

hey all, just starting with php, and was wondering if i could create a new web page by using a variable from a php script in a php script. For example, the user enters a word, and then a web page is created that is called that word. so user enters "daniweb" and the page is called "daniweb.php". also, if possible could i include content on this newly created page, such as a php script? thanks for any suggestions!

  • 2 Contributors
  • 2 Replies
  • 246 Views
  • 23 Hours Discussion Span
  • Latest Post Latest Post by david cashin

Dani AI

Generated

Good question, — and good start from pointing out that you can create files from PHP. That will work, but it’s worth considering safer, more maintainable approaches and a few hard rules before you let user input name pages.

A safer pattern is to generate a “slug” and serve pages dynamically from a single template (or from a database) instead of creating executable .php files for every user input. Create a normalized slug, map it to stored content, and use a rewrite rule so requests like /daniweb hit one script (example slugify and a simple rewrite):

function slugify($s) {
  $s = strtolower($s);
  $s = preg_replace('/[^a-z0-9\-]+/', '-', $s);
  $s = trim($s, '-');
  return $s === '' ? 'page' : $s;
}

# .htaccess (example)
RewriteEngine On
RewriteRule ^([a-z0-9-]+)/?$ view.php?slug=$1 [L,QSA]

Store title/content in a database and fetch by slug with prepared statements. Always escape or sanitize output — use htmlspecialchars() for plain text, or a vetted HTML sanitizer for user HTML. Minimal retrieval example pattern:

$stmt = $pdo->prepare('SELECT title, content FROM pages WHERE slug = ?');
$stmt->execute([$slug]);
$page = $stmt->fetch();
if (!$page) { http_response_code(404); exit; }
echo '<h1>'.htmlspecialchars($page['title']).'</h1>';
echo $page['content']; // sanitize if it contains HTML

If you must create files: write non-executable files (e.g., .html) into a dedicated directory outside the document root when possible, enforce a strict slug regex, use atomic writes (file_put_contents(..., LOCK_EX)), set safe permissions (chmod(..., 0644)), and never write raw PHP that you will execute. Also enforce authentication, rate limits, and a whitelist of allowed names to prevent abuse.

Checklist: normalize input, whitelist characters/length, avoid writing executable PHP, sanitize stored HTML, use prepared statements, and keep creations outside webroot or served by a single templating script.

Recommended Answers

All 2 Replies

Member Avatar for FlashCreations

What you are looking for is file writing/reading operations. For this you use fopen along with the w parameter which tells PHP you want to write to the file (and create it if it doesn't already exist).

$name = $_GET['name']; //Or where-ever you get the file name
//Sanatize
$name = str_replace('\\', '', $name);
$name = str_replace('/', '', $name);

//Open the file
$f = fopen('safedir/'.$name.'.php' , 'w');
//Write to the file
fwrite($f, "Hello World! Your code or HTML should go here.");
//Close file
fclose($f);

//Next, redirect to the new file
header("Location: safedir/{$name}.php");
Edited by FlashCreations because: n/a
Member Avatar for david cashin

Great, exactly what I was looking for! thank you!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.