Skip navigation.
Home

How not to shell script with PHP...

Bad Architecture

Since I'm doing a Shell Scripting with PHP presentation today's WTF is well timed for some shameless self promotion. It's a great example of one of the worst application requirements I've seen.

Props to Eero for sending this in. This script basically rotates an image on a web site. There are dozens of ways to do this with PHP and none of the good ways I know uses an FTP connection!

I particularly like how the permissions are changed to 0777, renamed, and then permissions changed back to 0444! Hmm...

#!/usr/bin/php
<?php
// ftp-connection to change rights
require("ftpconnect.php");
// get actual picture-infos
$filename = "actual_pic.txt";
$file = fopen($filename,"r+");
$actual_pic = fread ($file, filesize ($filename));
fclose($file);
// find out which pic is next
if($actual_pic == 10)
       $new_pic = 1;
else
       $new_pic = $actual_pic + 1;
// write new pic into log
$filename = "actual_pic.txt";
$file = fopen($filename,"w+");
fwrite( $file, $new_pic );
fclose($file);
// change access of folders/files
$ftp_actual_pic = "/www/folder/realpicture.jpg";
$ftp_new_pic = "/www/folder/$new_pic.jpg";
$ftp_folder = "/www/folder";
$chmod=ftp_site($conn_id, "CHMOD 0777 ".$ftp_folder."/realpicture.jpg");
$chmod=ftp_site($conn_id, "CHMOD 0777 ".$ftp_folder."/$new_pic.jpg");
$chmod=ftp_site($conn_id, "CHMOD 0777 ".$ftp_folder);
// rename pictures
rename("superheroes.jpg", "$actual_pic.jpg");
rename("$new_pic.jpg", "realpicture.jpg");
// Folder-Access reset
$chmod=ftp_site($conn_id, "CHMOD 0444 ".$ftp_folder."/realpicture.jpg");
$chmod=ftp_site($conn_id, "CHMOD 0444 ".$ftp_folder."/$actual_pic.jpg");
$chmod=ftp_site($conn_id, "CHMOD 0555 ".$ftp_folder);
ftp_quit($conn_id);
?>

I can think of only one reason why this code exists. Somebody has a web server that does not support scripting and wrote this shell script to rotate the images over FTP via a cron job. Still qualifies as a WTF because anything that automaticaly logs in to make updates to the website is just bad. I can't help thinking this code was written by a 12 year old updating his geocities site...

A function made up of WTFs...

Wonky Code

Props to Alex @ thedailywtf.com for today's PHP WTF.

I'm rating this as a WTF because:

  1. The function only returns a NULL!
  2. It uses references to return values
  3. It pretty pointless, especially when you have $_GET
  4. It's doesn't really work
  5. $argv will always have just one element, unless you're running PHP as a shell script interpreter. Then maybe there would be more than 1 argument.
  6. $seperator[0] - WTF?! oh why!?
  7. It's just soooooo bad. This function is basically made up of different WTF's.

I hope this isn't used in production somewhere... <?php
/* joins argv into one string and then splits it into logical
elements (html formated)*/

function split_arguments($argv,$argc,&amp;$nr_arg,&amp;$args)
{
       
$str="";
       
$seperator = "&";
       for (
$i=0; $i&lt;$argc; $i++)
       {
               if (
$i==0) {
                       
$str = sprintf("%s",$argv[$i]);
               } else {
                       
$str = sprintf("%s %s",$str,$argv[$i]);
               }
       }
       
trim($str);
       for (
$i=0; $i&lt;strlen($str); $i++)
       {
               if (
$str[$i] == $seperator[0])
               {
                       
$nr_arg++;
               } else {
                       
$args[$nr_arg] .= $str[$i];
               }
       }
       unset(
$str);
       for (
$i=0; $i&lt;=$nr_arg; $i++)
       {
               
$args[$i] = rawurldecode($args[$i]);
       }
       return;
}
?>

I particularly love the way $str is concatenated! I've never seen it done like this before:

<?php
if ($i==0) {
        
$str = sprintf("%s",$argv[$i]);
} else {
        
$str = sprintf("%s %s",$str,$argv[$i]);
}
?>