updating .htpasswd file

[Estella]

Hi

Can anyone spot the obvious mistake in the below??

exec("htpasswd -b ".$_POST['username']." ".$_POST['password_1'])
or die(".htpasswd file update has failed");

The .htpasswd file for the purpose of this test is in the same directory as the script running the above code.

Thanks for your help

Estella

[Gentoo]

are you allowed to use exec() with your hosting? some have it disabled

[boccio]

you didn't specify file name - .htpasswd

exec("htpasswd -b .htpasswd ".$_POST['username']." ".$_POST['password_1'])
or die(".htpasswd file update has failed");

[okrogius]

Actually the obvious mistake is lack of any validation/cleaning done on the _POST variables. Never trust user input untill you implicitly make sure it's safe. Plus making the htpasswd file world writable may not be the best idea either.