creating user directories

automated script

[NogginAnimations]

I have a script ready for my website which creates a directory if it does not already exist.
This is for an easier usersystem.
The script goes like this:

<?php
$username = "Noggin";
$filename = '/'.$username.'/index.php';
if (!file_exists($filename)) {
$mk = mkdir("/".$username, 0700);
if (!$mk) {
echo "Failed to create directory...";
 } else {
$file = 'res/php/userDIRECTORYcreate.php';
$newfile = '/'.$username.'/index.php';
if (!copy($file, $newfile)) {
echo "failed to copy ".$file."...";
 }
 }
}
?>

And I'm getting this permissions error:

Warning: mkdir() [function.mkdir]: SAFE MODE Restriction in effect. The script whose uid is 50001 is not allowed to access / owned by uid 0 in /####/##/###/###/###/#/####/web/example.com/usercreate.php on line 4

I realise that it is a permissions error, and I also realise that turning safe mode off would allow the script to process, but will this make my website more vulnerable to hackers?
Plus, is there a way to correct the script without altering safe mode?

[edited by: NogginAnimations at 9:49 pm (utc) on Jan. 10, 2008]

[edited by: jatar_k at 4:53 pm (utc) on Jan. 11, 2008]
[edit reason] please use example.com [/edit]

[venelin13]

Hello,
try to use the PHP's FTP functions, such as ftp_mkdir()

[php.net...]

It will work pretty good when you have SAFE MODE enabled.

[henry0]

You need reading about security
and make scripts that perform well (security wise) with safe mode off.

Safe mode
register global
and magic quote gpc
should be turned off.

Most recent php versions do have safe mode and reg glob off by default.
So I see two problems
One you are runnng an outdated php
Two your sripts need to be modified before your host
decide to update

[NogginAnimations]

Thanks guys, I managed to make it work thanks to venelin13's FTP reccomendation.

This is the script I used:

<?php
$ftp_server = "ftp.server.com";
$ftp_user = "username";
$ftp_pass = "password";
$username = $_REQUEST['usernm'];
$usernm = strtolower($username);
$dir = ($usernm);
// set up a connection or die
$conn_id = ftp_connect($ftp_server) or die("Couldn't connect to $ftp_server"); 
// try to login
if (@ftp_login($conn_id, $ftp_user, $ftp_pass)) {
 echo "Connected as $ftp_user@$ftp_server\n";
 // try to create the directory $dir
 if (!file_exists("/".$dir."/index.php")) {
 if (ftp_mkdir($conn_id, $dir)) {
 echo "<br />successfully created $dir\n";
 echo "<br /><br />If your browser does not automatically take you back, there's a problem.<br />Try turning on javascript!";
 echo '<meta http-equiv="refresh" content="0;url=http://www.example.com/index.php?p=profile&u='.$username.'">';
 echo '<CFHEADER name="Location" value="http://www.example.com/index.php?p=profile&u='.$username.'">';
 echo "<script type='text/javascript'>window.location = 'http://www.example.com/index.php?p=profile&u=".$username."'</script>";
 } else {
 echo "There was a problem while creating $dir\n";
 }
 if (!copy('userredir.php', ($dir.'/index.php'))) {
 echo "failed to copy $file...\n";
 }
 }
} else {
 echo "Couldn't connect as $ftp_user\n";
}
// close the connection
ftp_close($conn_id);
?>

[edited by: eelixduppy at 11:01 pm (utc) on Jan. 13, 2008]
[edit reason] example.com [/edit]