Need help with the file exists() Thing.

File_exists(), help!

[PokeTech]

Well I've been trying to get this to work for a while but had no luck, then started posting on forums to see if people could help me, and have had no luck there. So Here's the code:

add.php

<form action="process.php" method="POST">
<table align="center" width="50%" border="0" class="style1" style="margin-bottom:100px;">
<tr>
 <td valign="top">Username:</td>
 <td><input name="name" type="text" size="30" maxlength="30" title="Username"/></td>
</tr>
<tr>
 <td valign="top">Game Name:</td>
 <td><input name="gamename" type="text" size="30" maxlength="30" title="Game Name"/></td>
</tr>
<tr>
 <td></td><td valign="top">
</tr>
<tr>
 <td valign="top">E-Mail:</td>
 <td><input name="contact" type="text" size="30" maxlength="35" title="E-Mail"/></td>
</tr>
<tr>
 <td valign="top">Friend Code:</td>
 <td>
 <input name="code1" type="text" size="4" maxlength="4"/> <input name="code2" type="text" size="4" maxlength="4" /> <input name="code3" type="text" size="4" maxlength="4"/></td>
</tr>
<tr>
 <td valign="top">Country:</td>
 <td><input name="country" type="text" size="30" maxlength="100"/></td>
</tr>
<tr>
<tr>
 <td valign="top">Card:</td>
 <td><input name="card" type="text" size="30" maxlength="9999"/></td>
</tr>
<tr>
 <td valign="top">Bio:</td>
 <td><textarea cols=40 rows=5 name=bio wrap=virtual></textarea></td>
</tr>
<tr>
 <td colspan=2 align=center>
<input type=submit value=" Submit ">
<input type="reset" name="Reset" value="Reset" >
 <td>
</tr>
</table>
</form>

Then through form action, its processed in my process.php

<?
$name = $_POST['name'];
$center="<br><center>";
$ecenter="</center>";
$header="";
$bottom="";
if(isset($name, $gamename, $contact, $code1, $code2, $code3, $country, $card, $bio)) {
$fp = fopen("/home/www/example.net/site/wi-fi/users/$name.php","a");
$filename="../users/$name.php";
?>
<?
if (file_exists($filename)) {
 echo "<br><center>Username Already excists, Please choose a different one</center>";
} else {
 echo "<br><center>Your page is here: <a href=/site/wi-fi/users/$name.php>http://example.net/site/wi-fi/users/$name.php</a></center>";
}
?>
<?
fputs($fp,($header).'<?PHP include("/home/www/example.com/top.php");?>');
fputs($fp,nl2br($center).'<table border="1"><tr><td>Username:</td><td>');
fputs($fp,nl2br($name).'</td></tr><tr><td>Game Name:</td><td>');
fputs($fp,nl2br($gamename).'</td></tr><tr><td>Contact:</td><td>');
fputs($fp,nl2br($contact).'</td></tr><tr><td>Friend Code:</td><td>');
fputs($fp,nl2br($code1).'-');
fputs($fp,nl2br($code2).'-');
fputs($fp,nl2br($code3).'</td></tr><tr><td>Country:</td><td>');
fputs($fp,nl2br($country).'</td></tr><tr><td>Trainer Card:</td><td><img src="');
fputs($fp,nl2br($card).'"></td></tr><tr><td>Bio:</td><td>');
fputs($fp,nl2br($bio).'</td></tr></table>');
fputs($fp,nl2br($ecenter).'');
fputs($fp,($bottom).'<?PHP
include("/home/www/example.com/bottom.php");?>');
fclose($fp);
} 
?>

When the user types there username into the form on the add.php page it creats a file in a directory. I'm trying to get the file exists function to work so that instead of it saying "Your page is here: " when that page already exists I want it to say "Username is already in use."

If someone could help me with this, that would be great!

[edited by: eelixduppy at 7:13 pm (utc) on Feb. 2, 2008]
[edit reason] example.com [/edit]

[cameraman]

If you look here:
$fp = fopen("/home/www/example.net/site/wi-fi/users/$name.php","a");
$filename="../users/$name.php";
?>
<?
if (file_exists($filename)) {

You're always creating (if it doesn't already exist) the file. But you're making up a different path to test, unless your process.php script is executing from a subdirectory of wi-fi. So depending on where process.php is located, the file will either always exist or never exist.

Set up the file path and put it into a variable, e.g.
$fspec = "/home/www/example.net/site/wi-fi/users/$name.php";

then test to see if it exists. If it doesn't, then create it with fopen().

Where you're assigning $_POST['name'] to $name, you should do that with your other posted variables as well, otherwise some day your host is going to turn off register_globals [php.net] and your script will stop working. Change up the isset() line to check them for being empty.

You should also check all your posted variables for funny business. I could tell you my name is "../../index.php" and that my gamename is "<a href="example.com/phishing">Click here to continue</a>" or I could probably even input some javascript and redirect people over to my phishing site directly.

[edited by: eelixduppy at 7:14 pm (utc) on Feb. 2, 2008]
[edit reason] example.com [/edit]