Site creation file with PHP Here is something I've been working on today..

I been trying to determine how to build a website, that has a form, and that form allows a user to make a simple URL to give out. In the future it will also create a website, or possible websites (based off of varying templates that I have built for it). 

I just started trying to understand this today, so bear with me... 

So far, as far as I am aware, all of the code works and accomplishes the following:


Allows a user to input a Website name.. I keep both a version with spaces, and a version without spaces.
It creates a directory for that name with no spaces, and it creates a index.php in that directory.
It then displays the link to said directory(will not work on this code because I use a generic primary domain name).


Example Test Domain:


  www.PrimaryDomain.com/Test/


Example User Input:


$_POST['Dir'] = 'Test User Domain';



&lt;?php
//Make sure server is in post mode
if($_SERVER['REQUEST_METHOD'] != 'POST')
    {
        //display form
        echo'&lt;form name="" action="" method="post" class="wpcf7-form" &gt;';
            echo'&lt;input name="Dir" type="text" placeholder="Username" required autofocus&gt;';
            echo'&lt;input type="submit" value="Start" class="wpcf7-form-control wpcf7-submit"&gt;';
        echo'&lt;/form&gt;';
    }
else
{
    //Specify the URL
    $Name = mysql_real_escape_string($_POST['Dir']); //form data
    $CurrentDir = getcwd(); //current directory
    $URL = ''.$CurrentDir.'/'.$Name.'/'; //New url to create

    //Speciy the file to create
    $Index_file = ''.$URL.'index.php'; //location of new index.php file

    //Remove the spaces, and make each it's own variable
    $Index_file = str_replace(' ', '', $Index_file); //the location of index.php
    $Dir_No_Space = str_replace(' ', '', $URL); //the main directory
    $Name_No_Space = str_replace(' ', '', $Name); //the form data the user entered

    mkdir('/'.$Dir_No_Space.'', 0777, true); //make the directory
    $handle = fopen($Index_file, 'w') or die('Cannot open file:  '.$Index_file); //Create the index.php File

    //Source code of the File: index.php
    $index_data = '

    &lt;html&gt;
        &lt;head&gt;
        &lt;/head&gt;
        &lt;body&gt;
            &lt;p&gt;This is an example&lt;/p&gt;
        &lt;/body&gt;
    &lt;/html&gt;

    ';

    fwrite($handle, $index_data); //write the source code to the index.php file

    //Check the Document Creation
    if(!fwrite)//if error
        {
        echo'Error &lt;br&gt;';
        echo mysql_error(); //debugging
        }

    else//if not error
        {
        //tell the user how to access the new page
        echo'&lt;p&gt;This is a test in progress for '.$Name.' View @ &lt;a href="http://www.PrimaryDomain.com/Test/'.$Name_No_Space.'/"&gt;www.PrimaryDomain.com/Test/'.$Name_No_Space.'/&lt;/a&gt;.';
        }
}
?&gt;


What do you guys/gals think? Is there a better method for this?
It's bizarre that you are calling mysql_escape_string() and mysql_error() for code that has nothing to do with MySQL.  Why are you calling arbitrary escaping functions?  You should always know why you are escaping a string.

The most severe problem is that you don't validate the $_POST['Dir'].  If the file path contains ../, then the script will overwrite any file of the attacker's choosing, subject only to the permissions of the webserver process.

The space/no-space scheme is baffling.  Why are you doing that?  You should either eliminate all characters that fall outside a safe set (e.g. A-Z, a-z, 0-9, dot, hyphen, and underscore), or diligently apply percent-encoding to URLs.