title: Write to text file outside of webroot directory
body: <p>I am trying to use PHP to read and write from a text file. A file is read using a button on an html page. The file is written using a button on an html page that takes a parameter from a textbox. I was successful in writing to a text file when the text file is in the webroot directory. I want to be able to read/write from a text file that lives outside of the webroot directory.</p>
  
  <p>I am using lighttpd with PHP on a Beaglebone. The webroot directory is located at <code>/var/www</code>. The text file that I want to edit will be located at <code>/var/textFiles</code>. I have looked around everywhere for solutions, but none seem to work. </p>
  
  <p>The following is the most promising solution that I have found, but it does not seem to work. When I click the "read" or the "write" button the page seems to be stuck in an infinite loop. I was wondering if anyone knows why this doesn't work or if they can offer a better solution.</p>
  
  <p>This is what I have so far:</p>
  
  <p>index.php</p>
  
  <pre><code>&lt;?php 
  echo '&lt;script language="javascript" type="text/javascript" src="jquery-1.9.0.min.js"&gt;&lt;/script&gt;';
  echo "&lt;form name='write' action='writeFunctionCaller.php' method='post'&gt;Input text to 
  write to text file: &lt;input type='text' name='input'&gt;
  &lt;input type='submit' value='Write' &gt;&lt;/form&gt;
  &lt;form name = 'read' action='readFunctionCaller.php' method='get'&gt;
  &lt;input type='submit' value='Read'&gt;&lt;/form&gt;&lt;br&gt;&lt;div id='fileContent'&gt;&lt;/div&gt;";
  
  class readWriteModel {
  
     function readFile() {
          $file_handle = fopen("secure.php?file=phpRead.txt", "r");
          while (!feof($file_handle)) {
              $line = fgets($file_handle);
              echo $line;
              echo '&lt;br&gt;';
          }
          fclose($file_handle); 
      }
  
      function writeFile($text) {
          echo ("Write Success! ");
          $filename = "secure.php?file=phpRead.txt";
          file_put_contents($filename, $text, FILE_APPEND | LOCK_EX);
      }
  }
  ?&gt;
  </code></pre>
  
  <p>secure.php</p>
  
  <pre><code>&lt;?php
  //validate that the user should have access to the file here
  
  //Make sure it exists
  $folder = realpath('/var/textFiles');
  if(!$file = realpath($folder.'/'.$_GET['file']))
      error(404);
  if(!is_file($file))
      error(404);
  
  //Check for cheaters
  if(substr($file,0,strlen($folder)) !== $folder)
      error(401);
  
  header(sprintf("Content-type: %s;",getMimeType($file)));
  readfile($file);
  exit;
  
  function error ( $code = 401, $msg = null ) {
      $msgs = array(
        400 =&gt; 'Bad Request',
        401 =&gt; 'Unauthorized',
        402 =&gt; 'Payment Required',
        403 =&gt; 'Forbidden',
        404 =&gt; 'Not Found',
      );
      if(!$msg) $msg = $msgs[$code];
      header(sprintf('HTTP/1.0 %s %s',$code,$msg));
      printf('&lt;html&gt;&lt;head&gt;&lt;title&gt;%s %s&lt;/title&gt;&lt;/head&gt;&lt;body&gt;&lt;h1&gt;%s&lt;/h1&gt;&lt;/body&gt; 
      &lt;/html&gt;',$code,$msg,$msg);
      exit;
  }
  
  function getMimeType ( $filename ) {
      //MIME MAP
      $mime_extension_map = array(
      'txt'           =&gt; 'text/plain',
      );
      //Get Extension
      $ext = strtolower(substr($filename,strrpos($filename,'.') + 1));
      if(empty($ext))
        return 'application/octet-stream';
      elseif(isset($mime_extension_map[$ext]))
        return $mime_extension_map[$ext];
      return 'x-extension/' . $ext;
  }
  ?&gt;
  </code></pre>
  
  <p>writeFunctionCaller.php</p>
  
  <pre><code>&lt;?php 
  include_once('index.php');
  $text = $_POST['input'];
  $model = new readWriteModel();
  $model-&gt;writeFile($text);
  ?&gt;
  </code></pre>
  
  <p>readFunctionCaller.php</p>
  
  <pre><code>&lt;?php 
  include_once('index.php');
  $model = new readWriteModel();
  $model-&gt;readFile();
  ?&gt;
  </code></pre>