remove character replace in php script for external txt files

[Siddan]

Hey

I have a php photoalbum which is very greatastic with only a single file.
With it I can create a folder and have textfiles for each image to show the desired text under the image...

but

the characters < and > inside that textfile is replaced with html character &lt; and &gt; when viewing the source. I would like to insert an echo inside the textfiles but cannot with this character replacement.

I have searched throughout the php script and even desperately enough I have removed every line that has something with _replace in it hehe. That didn´t help.

So is there another method of replacing I can look for?

[LiLcRaZyFuZzY]

htmlspecialchars() (http://php.net/htmlspecialchars)
strip_tags() (http://php.net/strip_tags)

but you shouldn't probably remove them, or it might turn <> into actual html

[Siddan]

It is only me who puts the text in those text-files and sometimes I actually do need to put in som html for italic text, bold text or even decorated text sometimes.... and now most importantly I must put in a php echo code

I have searched for them two and no results

I may post the code here soon ... gotta strip out the unesseccary first cus overall there are about 2000 lines

[Siddan]

// Upload file(s)
if (isset($_FILES['uploadimage1']) || isset($_FILES['uploadimage2']) || isset($_FILES['uploadimage3']) || isset($_FILES['uploadimage4']) || isset($_FILES['uploadimage5']) || isset($_FILES['uploadimage6'])) {
for($i=1;$i<7;$i++) {
if (isset($_FILES['uploadimage' . $i])) {
$imagefilename=str_replace('/','',$_FILES['uploadimage' . $i]['name']);
$imagefilename=str_replace('..','',$imagefilename);
$extension=@ltrim(strtolower(substr($imagefilename,-4)),'.');
if ($extension=='jpg' || $extension=='jpeg' || $extension=='png' || $extension=='gif' || $extension='txt') {
if ($extension!='txt') {
@move_uploaded_file($_FILES['uploadimage' . $i]['tmp_name'],str_replace(chr(92),chr(47),getcwd()).'/'.$imagefilename);
if (filesize($imagefilename)==0)
@unlink($imagefilename);
} else if (is_dir('textfiles')) {
@move_uploaded_file($_FILES['uploadimage' . $i]['tmp_name'],str_replace(chr(92),chr(47),getcwd()).'/textfiles/'.$imagefilename);
if (filesize('textfiles/'.$imagefilename)==0)
@unlink('textfiles/'.$imagefilename);
} else {
@move_uploaded_file($_FILES['uploadimage' . $i]['tmp_name'],str_replace(chr(92),chr(47),getcwd()).'/'.$imagefilename);
if (filesize($imagefilename)==0)
@unlink($imagefilename);
}
if ($_FILES['uploadimage' . $i]['error']==UPLOAD_ERR_INI_SIZE)
$title.=" - (filesize too big)";
if ($_FILES['uploadimage' . $i]['error']==UPLOAD_ERR_PARTIAL)
$title.=" - (upload interrupted)";
}
}
}
}









// Add/edit text file for photo
if (isset($_REQUEST['phototextfile']) && isset($_REQUEST['phototext'])) {
if (is_dir('textfiles')) {
if ($fp=fopen('textfiles/'.$_REQUEST['phototextfile'],'w')) {
fwrite($fp,stripslashes($_REQUEST['phototext']));
fclose($fp);
}
} else {
if ($fp=fopen($_REQUEST['phototextfile'],'w')) {
fwrite($fp,stripslashes($_REQUEST['phototext']));
fclose($fp);
}
}
}










// Create text file for photo
if (isset($_REQUEST['newtxtfile'])) {
if (is_dir('textfiles')) {
if (file_exists($_REQUEST['newtxtfile']))
@touch('textfiles/'.substr($_REQUEST['newtxtfile'],0,strrpos($_REQUEST['newtxtfile'],'.')).'.txt');
} else {
if (file_exists($_REQUEST['newtxtfile']))
@touch(substr($_REQUEST['newtxtfile'],0,strrpos($_REQUEST['newtxtfile'],'.')).'.txt');
}
}





// Display textfile
if ($image_txtfile) {
$showimage_txt=substr($showimage,0,strrpos($showimage,'.')).'.txt';
if (file_exists($showimage_txt)) {
echo "<tr><td colspan=\"$columns_per_page\" class=\"tablecell\">\n";
$lines=file($showimage_txt);
foreach ($lines as $line)
echo htmlentities($line)."<br />";
echo "</td></tr>\n";
} else if (file_exists('textfiles/'.$showimage_txt)) {
echo "<tr><td colspan=\"$columns_per_page\" class=\"tablecell\">\n";
$lines=file('textfiles/'.$showimage_txt);
foreach ($lines as $line)
echo htmlentities($line)."<br />";
echo "</td></tr>\n";
}
}



This is what I could find which was relevant to the text file... and I really can´t see anything what is replacing the html characters... perhaps I have totally missed it somewhere else. I cannot post the entire code either cus it is too long

[LiLcRaZyFuZzY]

htmlentities() (http://php.net/htmlentities)

[Siddan]

mm yes. But that only appear to replace new lines with br, så when I press enter in thetext file to create a new line it will also create the br tag.

I´ve seen htmlentities appear in administrator section but that cannot inflict with what is displayed.. and it is only about $lines anyways

*sighs*

[Siddan]

You now what.. I just had a crazy thought...

Instead of trying to prevent the tag character replacement and putting up a textfile with the php code inside it corresponding to the image file name...
I thought maybe... perhaps... if there is a slight chance of effort to skip the textfile part and making a new variable instead.

Here is the php section of displaying text under an image:

// Display textfile
if ($image_txtfile) {
$showimage_txt=substr($showimage,0,strrpos($showimage,'.')).'.txt';
if (file_exists($showimage_txt)) {
echo "<tr><td colspan=\"$columns_per_page\" class=\"tablecell\">\n";
$lines=file($showimage_txt);
foreach ($lines as $line)
echo htmlentities($line)."<?php echo(TEXT) ?>";
echo "</td></tr>\n";
} else if (file_exists('textfiles/'.$showimage_txt)) {
echo "<tr><td colspan=\"$columns_per_page\" class=\"tablecell\">\n";
$lines=file('textfiles/'.$showimage_txt);
foreach ($lines as $line)
echo htmlentities($line)."$language_text";
echo "</td></tr>\n";
}
}


There you can see it takes the name of the image and the same name of the textfile to display.
So the idea is to leave the textfile out and add a new variable which should be like $language_"imagefilename.jpg"

For instance:
If the image file name is 990 forest.jpg then the variable would become like $language_990_forest.jpg

It will then display the text that corresponds to my language page... which I will add manually of course.
$language_990_forest.jpg= 'Very nice and green forest';
If there is no name found then it will not display any text at all.

This way would at least be alot easier for me, but I dunno about you guys :)

[Siddan]

So is no one able to help out a bit?.. do you need a more sample of code?

I have written to the owner of that php script, he replied back but the answer wasn´t so very satisfying, since I kinda already knew it and it doesn´t work. So he hasn´t replied on my second mail still..

This was his first reply:

Hi,

This is actually a safety precaution. Other people could also include
malicious (java)scripts and compromise your website.

If you still want to switch this safety off :) then find the section that
says 'display textfile' and remove the funtion htmlentities.

BR
Jos


This was about disabling the character replacement of "<" and ">". But the htmlentities only seem to affect <br />, as it says in the script. There are two of them and when I remove the second, all text will just end up in one single line. The characters "<" and ">" are still replaced with "&gt;" and "&lt;" in the source code

[Siddan]

Ok, I am a bit of a progress here. But I still need some helping hand with this bit of code:

// Display textfile
if ($image_txtfile) {
$showimage_txt=substr($showimage,0,strrpos($showimage,'.')).'_txt';
if (file_exists($showimage_txt)) {
echo "<tr><td colspan=\"$columns_per_page\" class=\"tablecell\">\n";
$lines=file($showimage_txt);
foreach ($lines as $line)
echo htmlentities($line)."<br />";
echo "</td></tr>\n";
} else if (file_exists('textfiles-se/'.$showimage_txt)) {
echo "<tr><td colspan=\"$columns_per_page\" class=\"tablecell\">\n";
$lines=file('textfiles-se/'.$showimage_txt);
foreach ($lines as $line)
echo htmlentities($line)."<?php echo(A$showimage_txt);?>";
echo "</td></tr>\n";
}
}


first... the $showimage will display the file name of an image with the extension .jpg
The $showimage_txt will have the extension .jpg subtracted and be replaced with _txt, as you can see from above 2nd line. I have changed the dot to an underscore instead so there won´t be any parsed error when calling the language text.

Now Comes my lil problem...
Every image filename starts with a 3 digit number like this 985 forest.jpg. So the problem is that there is a space between the number and the name. I need help subtracting the space and replace with an underscore so the final name will be like this A985_forest_txt

I have put a letter infront of the name because there will be an error if the name begins with a number.. obviously. So all I need help with is the space thing.


Thank you.... please

This line below I think will identify the letters. If it might help you out, it begins straight after the code above

$content='';
if ($show_name) {
$file_name=substr($showimage,0,strrpos($showimage,'.'));
if (ereg("([0-9]{3})",substr($file_name,0,3))) {
if (substr($file_name,3,1)==' ' || substr($file_name,3,1)=='_')
$file_name=trim(substr($file_name,3));
}
if (strpos($file_name,'/')!=false)
$file_name=substr($file_name,0,strpos($file_name,'/'));
$content.=str_replace('_',' ',$file_name) . "<br />";
}

[nabilozoglu@gma]

I need the quarry for web language machine only on English, Spanish and french.
i have a website and i want the language change to work went ever i click on any selected language.

Please assist me.