What kind of damage could I do if I could create a php file on someone else's server?

Depends what the file was. Although it's generally nothing. What was the contents of the file?

Jacob.

No it's not a file... I'm writing a script and I'm wondering what kind of security risks it has. It's a file editor but it saves the file to my server. Mainly designed for html but it works with php files too. Can any harm be done through this?

So it writes on their server buts sends to yours? Interesting...

Jacob.

No... I'm writing a script (on my server). Anyone can use it... It can save php files and I'm not sure if it's possible to do anything harmful to my server. Is there anything that can be done in php that can affect something else.

I am not 100% sure (depends on what is uploaded) but I think if you are unsure, put permissions in play. Allow certain things and then disallow things that could harm your server. Just like they do here at Zymic.

Jacob.

Yes, It's a quick way to hang yourself.

It does of course depend on the security considerations of the server, but even with base_dir and safe_mode you can still browse and view the contents within your webspace, so db passwords in configuration files are easily accessible.

If base_dir and safe_mode is off, it's even possible to be viewing all the content of all the other sites hosted on the server (providing php is running as an apache module), so in short, this is not a good idea at all... and very insecure.

So... I just recode it to not allow saving as a php file?

You'd want to make sure you're not allowing editing of your files though, can easily inject malware via javascript into some pages and no one be any the wiser. I'd think about writing some filtering layer with sanitizes anything that's being inserted, additionally some sort of access control layer, so if you need to add javascript for instance you can, but someone who doesn't have the correct flags for doing such a task can't.




What exactly is the purpose of them creating the files, maybe we can offer some suggestions?

I'm just writing a simple editing script... wanted to try new things with it so I wanted to add the possibility of uploading the file for an hour. Maybe show off your work for a certain amount of time or something Nothing that's really appealing but good for educational purposes.