Use php file to replace a few parts of a line in another file

Question

I just want to replace a few things in a file called "config.php"! Here is i section of the file that I want to edit. I want to use a form to set the values of the text in caps. I am stuck and I looked all over StackOverflow and google. I could not find anything.

$dbhost = "DBHOST";                          /*      "localhost"      */
$dbuname = "DBUSERNAME";                     /* "database user name"  */
$dbpass = "DBPASSWORD";                      /* "database password"   */
$dbname = "DBNAME";                          /*    "database name"    */

Also, how should the form look for this?

I have this..

<form action="edit.php">
        DB Server: <input type="text" name="host" placeholder="localhost"><br>
        DB Username: <input type="text" name="dbuser" placeholder="admin"><br>
        DB Password: <input type="password" name="dbpassword" placeholder="********"><br>
        DB Name: <input type="text" name="db_name" placeholder="pnc"><br>
        <button type="submit">Next Step</button>
</form>

Answer 1

Say you had this file:

/home/websites/example.com/conf.php

<?php

$dbhost = "DBHOST";                          /*      "localhost"      */
$dbuname = "DBUSERNAME";                     /* "database user name"  */
$dbpass = "DBPASSWORD";                      /* "database password"   */
$dbname = "DBNAME"; 

To replace those placeholder values, all you need is to get the page source in a variable and do some string replacing, then write it back to a file.

$confpath = '/home/websites/example.com/conf.php';
$confphp = file_get_contents($confphp);

// Note the POST values need to be CLEANED and validated first.
// This especially means whitelisting what characters are allowed
// in the POST-received variables, encoding and removing " and '.
// You have to be VERY careful to authentic the user, and verify
// that user has permissions to do what they're doing, with the 
// databases/tables they're working with, unless this is part of
// an install script, which would need to be removed immediately
// upon finishing the install.
$confphp = str_replace(
    array('DBHOST','DBUSERNAME','DBPASSWORD','DBNAME'),
    array(
        addslashes($post_cleaned_dbhost), 
        addslashes($post_cleaned_dbusername), 
        addslashes($post_cleaned_dbpassword), 
        addslashes($post_cleaned_db_name)
    ),
    $confphp
);

file_put_contents($confpath, $confphp);

Note the values you're replacing need to be unique to the text content of the file (e.g, no $DBUSERNAME in the same file), or it will replace those as well. It returns false if the file was not written, so you can test the return of file_put_contents() to verify it worked.

http://www.php.net/manual/en/function.file-get-contents.php

http://www.php.net/manual/en/function.file-put-contents.php

Answer 2

Do you want to create a form that will take user input and change the lines in the file? I wouldn't recommend setting your database connection from a form directly. But if it's necessary try using a normal format for storing data such as JSON

 $data = json_decode(file_get_contents($dataFileName));

to write

 file_put_contents(json_encode($data, $dataFileName));

for reference check http://www.php.net//manual/en/book.json.php

It will become clear that your file contains data if it is in a typical data format. You could name this database.json for instance

Create a file named database.json containing the following:

{
     "username": "...",
     "password": "...",
     "database": "...",
     "host": "..."
}

Then to read this data you can use

$data = json_decode(file_get_contents('database.json'));
$data['username'] = $newValue;
$username = $data['username'];

Once you set new values

file_put_contents(json_encode('database.json', $data));

There are issues with connecting to a database from user submitted data, eg switching to a different database and showing malicious data in your page that could be used for XSS http://en.wikipedia.org/wiki/Cross-site_scripting

Answer 3

Make a form with a controller

Form code in HTML

<form name="dbSet" id="dbSet" action="form_set_db.php" method="POST" />
    <label>Host</label> <input type="text" name="host" id="host" /><br />
    <label>Username</label> <input type="text" name="username" id="username" /><br />
    <label>Password</label> <input type="password" name="password" id="password" /><br />
    <label>Database</label> <input type="database" name="database" id="database" />
</form>

form_set_db.php

require_once 'config.php';
if(isset($_POST["host"], $_POST["username"], $_POST["password"], $_POST["database"]))
{
    $dbhost = $_POST["host"];
    $dbuname = $_POST["username"];
    $dbpass = $_POST["password"];
    $dbname = $_POST["database"];
}

This would replace the values of $dbhost $dbuname $dbpass $dbname with the values you entered in the form.

EDIT

Note that this only replaces it temporarily. If you want a permanently stored config file (if you're building an installer for example), I'd create the config.php file on the fly instead of having it created from the start. You'd then do something like this inside of form_set_db.php

if(isset($_POST["host"], $_POST["username"], $_POST["password"], $_POST["database"]))
{
    $file = fopen("config.php", "w");
    if(!is_resource($file)) { return false; }

    fwrite($file, "$dbhost = '" . $_POST["host"] . "';\n");
    fwrite($file, "$dbuname = '" . $_POST["username"] . "';\n");
    fwrite($file, "$dbpass = '" . $_POST["password"] . "';\n");
    fwrite($file, "$dbname = '" . $_POST["database"] . "';");

    fclose($file);
}