Site creation file with PHP
It's bizarre that you are calling mysql_escape_string() and mysql_error() for code that has nothing to do with MySQL.  Why are you calling arbitrary escaping functions?  You should always know why you are escaping a string.

The most severe problem is that you don't validate the $_POST['Dir'].  If the file path contains ../, then the script will overwrite any file of the attacker's choosing, subject only to the permissions of the webserver process.

The space/no-space scheme is baffling.  Why are you doing that?  You should either eliminate all characters that fall outside a safe set (e.g. A-Z, a-z, 0-9, dot, hyphen, and underscore), or diligently apply percent-encoding to URLs.