What's wrong with this code?

[bbf3]

Hey,
What is wrong with the following code here:

php:
<?php
$file = fopen("guestbook.xml", "w+") or die("Can't open XML file");
$xmlString = $HTTP_RAW_POST_DATA;
if(!fwrite($file, $xmlString)){
print "Error writing to XML-file";
}
print $xmlString."\n";
fclose($file);
?>


that I use for a flash guestbook with the following actionscript:
var currPage = 0;
var showAmount = 10; // set this to the amount of entries you want to view at a time
previous._visible = false;
createMessage._visible = false;
createButton.onRelease = function(){
this._visible = false;
this._parent.createMessage._visible = true;
if (createMessage.nameField.text == ""){
Selection.setFocus(createMessage.nameField);
}
else if (createMessage.messageField.text == ""){
Selection.setFocus(createMessage.messageField);
}
}

// **** Load XML ****************************
myXML = new XML();
myXML.ignoreWhite = true;
receiverXML = new XML();

myXML.onLoad = function(success){
myXML.contentType = "text/xml";
if (success){
this.showXML();
}
else{
trace("Error loading XML file");
}
}
myIdentifier=Math.round(Math.random()*10000);
myXML.load("guestbook.xml?uniq="+myIdentifier);

receiverXML.onLoad = function(){
this.contentType = "text/xml";
_root.currPage = 0;
this.showXML();
}
createMessage.closeButton.onRelease = function(){
this._parent._visible = false;
createButton._visible = true;
}
createMessage.sendButton.onRelease = function(){
var myName = this._parent.nameField.text;
var myMessage = this._parent.messageField.text;
if (myName == ""){
this._parent.errorField.text = "please fill out your name";
Selection.setFocus(this._parent.nameField);
}
else if (myMessage == ""){
this._parent.errorField.text = "please leave a message";
Selection.setFocus(this._parent.messageField);
}
else {
myXML.firstChild.appendChild(myXML.createElement("entry"));
myXML.firstChild.lastChild.attributes.myName = myName;
myXML.firstChild.lastChild.appendChild(myXML.creat eElement("myText"));
myXML.firstChild.lastChild.lastChild.appendChild(m yXML.createTextNode(myMessage));
myXML.sendAndLoad("processXML.php", receiverXML);
this._parent._visible = false;
createButton._visible = true;
}
}
XML.prototype.showXML = function(){
myGuestbook.scroll = 1;
myGuestbook.htmlText = "";
var numItems = this.firstChild.childNodes.length;
var firstItem = numItems - (currPage*showAmount);
if (currPage == 0) previous._visible = false;
var lastItem = firstItem - showAmount ;
if (lastItem<=0) {
lastItem = 0;
next._visible = false;
}
myCount.text = "Total messages: " + numItems;
if (firstItem == lastItem+1) nowShowing.text = "Showing message " + firstItem;
else nowShowing.text = "Showing message " + firstItem + " to " + (lastItem + 1);
for (i=(firstItem-1); i>= lastItem; i--){
myGuestbook.htmlText += "<B>" + this.firstChild.childNodes[i].attributes.myName + "</B> wrote:\n";
myGuestbook.htmlText += this.firstChild.childNodes[i].firstChild.firstChild.nodeValue + "\n\n";
}
}
previous.onRelease = function(){
currPage--;
myXML.showXML();
next._visible = true;
}
next.onRelease = function(){
currPage++;
myXML.showXML();
previous._visible = true;
}

This has been operational on a site for over a year. Three weeks ago, suddenly I find the guestbook.xml file completely erased (xml tags and content). So I reupped the file:

<?xml version="1.0"?>
<guestbook>
<entry myName="web admin">
<myText>The guestbook is working. </myText>
</entry>
</guestbook>

only to find it erased again last night. Is this the work of a hacker? Is my code wrong/corrupt? What's going on?

Thanks,
Blake

[jsebrech]

Your server-side script writes the entire posted data straight to the xml file, without any checks. A user can easily fake a HTTP POST request that uploads an empty file. This is probably what you're seeing.

You can try two approaches:
- include a variable in your flash file that the php script checks, and rely on the user not being able to decompile your flash file
- add checks on the content of the submitted post data in the php script

One thing to watch out for with your current script is that they may in fact upload a php or asp script, and execute that. In that case your entire web server could become compromised (depending on the file rights).

[bbf3]

Thanks for your answer. As I am pretty unfamiliar with php, could you recommend a good tutorial on this or an example of securing the php. In the meantime, I will do some research on the subject.

Thanks
B