Date: 01/12/08 (PHP Community)    Keywords: php, xml, security, web

I have a file /home/me/xml/email.xml that is created via PHP running from within stub-executable (/xml folder only permits "cgi" user to write to it).

Problem is that I normally use TCL to write XML files, but because of my need to use $_SESSION for security reasons, I am having to do the entire program in PHP.

/home/me/xml/email.xml is there when I do echo file_get_contents('/home/me/xml/email.xml'); however, I can't SEE the file no matter what tool I use.

Here is the code that creates the email.xml file:

	if (!function_exists('submit_email')) {
		function submit_email($sessionName = '') {
			global $userPath;

			if (is_file("$userPath/xml/email.xml")) $contents = file_get_contents("$userPath/xml/email.xml");
			if (!$contents) { /* NEW CONTENTS */
				// DON'T FORGET YOU CAN'T HAVE < OR > NEXT TO ? ANYWHERE IN PHP UNLESS IT'S A COMMAND BLOCK DELIMITER!
				$contents = '<' . '?xml version="1.0" encoding="utf-8"?' . '>';
			} else {
			 	// YOU WILL HAVE TO LOB OFF THE  CLOSING TAG ELSE YOU WILL HAVE MALFORMED XML
			 	$contents = preg_replace('/<\/emailalert>$/i', '', $contents);
			}
			$contents .= '';

			// RE-INSERT INTO email.xml
			$isSuccessful = true;
			//@unlink("$userPath/xml/email.xml"); // FOR SOME REASON IT DOES NOT CLEAR OUT CONTENT USING 'w' OPTION
			if (!file_put_contents("$userPath/xml/email.xml", $contents, 'w')) $isSuccessful = false;
			if ($isSuccessful) chown("$userPath/xml/email.xml", 'ppowell');
			if ($isSuccessful) $msg = exec("chown ppowell:users \"$userPath/xml/email.xml\"");
			if ($isSuccessful) chmod("$userPath/xml/email.xml", 700);
			if ($msg) print_r($msg);
			if ($isSuccessful && !is_file("$userPath/xml/email.xml")) $isSuccessful = false;

			// REMOVE SESSION (OPTIONAL) AND RETURN FALSE
			if (!$isSuccessful) {
			 if ($sessionName && isset($_SESSION[$sessionName])) unset($_SESSION[$sessionName]);
			 return false;
			}
		
			return true;
		}
	}

Source: http://community.livejournal.com/php/609267.html