PHP安全写入文本文件？

Question

An HTML form, a php file and a text file.

The form has one input box, it sends the inputted string to the PHP file using GET or POST. The PHP file writes the string to the text file using fopen 'a', fwrite and fclose and does no sanitization at all.

The text file is set to permission 777 and is in the same folder as the other files.

Are there any security concerns here? Is it possible for someone to send something using the form that will do any damage? If yes, what?

What about if the txt file is set to 666?

Answer 1

Never execute

Depending on what the use of this file, there shouldn't be much risk involved. Just make sure the file is never executed.

This means, never eval() the content of this file, or change it into a .php or any other executable file.

However, if the content is ever to be written on a page, or viewable by the user, you will have security risks doing this.