PHP文件删除问题？

Question

I have the following HTML form:

<form action='delete.php' method='POST'>
    <table>
        <div class = '.table'>
            <?php
            $dir = '../uploads/store/';
            $newdir = ereg_replace('\.','',$dir);

            if (is_dir($dir)) {
               if ($dh = opendir($dir)) {
                  while (($file = readdir($dh)) !== false) {
                     if (!preg_match('/^(\.(htaccess|\.)?|index\.html)/',$file)) {
                        echo "<tr><td><font color = 'white'><a href='$newdir$file'>$file</a></font></td>";
                        echo "<td><input type='submit' value ='Delete'></td></tr>";
                        echo "<input align='right' type='hidden' value='$file' name='file'>";
                     }
                  }
                  closedir($dh);
               }
            }
            ?>
        </div>
    </table>
</form>

Which links to the following PHP script:

<?php
    session_start();

    $file = $_POST['file'];
    $dir = '../uploads/store/';
    $file = $dir . $file;

    opendir($dir);

    if(unlink($file)) {
        echo "File sucessfully deleted";
        $_SESSION['username'] = 'guitarman0831';
        header('Refresh: 2;url=http://www.ohjustthatguy.com/uploads/uploads.html');
    } else {
        echo "Error: File could not be deleted";
        $_SESSION['username'] = 'guitarman0831';
        header('Refresh: 2;url=http://www.ohjustthatguy.com/uploads/uploads.html');
    }

?>

However, when the Delete button is pressed in the HTML form, the item above the one intended to delete is deleted.

Hope this makes sense.

NOTE: I'm not going for security with these scripts, I'm going to work on that later. It's only me using this service right now.

Answer 1

Your HTML form needs to have the various submit buttons pass the value for $file instead of using hidden fields.

The problem is that all of the hidden fields are POSTed to delete.php when you submit the form. Then, since you haven't used the PHP-friendly HTML array variable syntax, PHP uses only the last of these to set the value of $_POST['file']. If you do a var_dump of $_POST in delete.php, you will see what the POSTed input is.

The easiest thing to do, with your current markup, is just to have each submit button be named file and pass $file as its value. i.e. you could do:

<button name="file" value="example.txt" type="submit">Delete</button>

Alternately, you could use radio buttons or some other markup.