PHP Delete File script

I have a basic PHP script that displays the file contents of a directory. Here is the script:

<?php

$Dept = "deptTemplate";

if(isset($_REQUEST['dir'])) {  
    $current_dir = $_REQUEST['dir'];  
} else {
    $current_dir = 'docs';
}

if ($handle = opendir($current_dir)) {  
     while (false !== ($file_or_dir = readdir($handle))) {  
        if(in_array($file_or_dir, array('.', '..'))) continue;  
        $path = $current_dir.'/'.$file_or_dir;  
        if(is_file($path)) {  
            echo '`<a href="/Implementation/'.$Dept.'/'.$path.'">'.$file_or_dir.'</a> - [Delete button/link]<br/>`';  
 开发者_JAVA百科       } else {  
            echo '`<a href="testFolderiFrame.php?dir='.$path.'">`'.$file_or_dir."\n`</a>` - [Delete button/link]`<br/>`";  
        }
    }
    closedir($handle);  
}
?> 

I am trying to create a delete link/button that displays next to each file and when clicked, the corresponding file will be deleted. Would you know how to do this?

---

Use the built-in unlink($filepath) function.

---

Sure, you'd have to use unlink() and rmdir(), and you'd need a recursive directory removal function because rmdir() doesn't work on directories with files in them. You'd also want to make sure that the deletion script is really secure to stop people from just deleting everything.

Something like this for the recursive function:

function Remove_Dir($dir)
{
     $error = array();
     if(is_dir($dir))
     {
          $files = scandir($dir);  //scandir() returns an array of all files/directories in the directory
          foreach($files as $file)
          {
               $fullpath = $dir . "/" . $file;
               if($file == '..' || $file == '.')  
               {
                   continue;  //Skip if ".." or "."
               }
               elseif(is_dir($fullpath))
               {
                   Remove_Dir($fullpath); //recursively remove nested directories if directory
               }
               elseif(is_file($fullpath))
               {
                   unlink($fullpath); //Delete file otherwise
               }
               else
               {
                   $error[] = 'Error on ' . $fullpath . '.  Not Directory or File.'  //Should be impossible error, because everything in a directory should be a file or directory, or . or .., and thus should be covered.
               }
           }

           $files = scandir($dir);  //Check directory again
           if(count($files) > 2) //if $files contains more than . and ..
           {
                Remove_Dir($dir);
           }
           else
           {
                rmdir($dir); //Remove directory once all files/directories are removed from within it.
           }
           if(count($error) != 0)
           {return $error;}
           else
           {return true;}
     }
}

Then you just need to pass the file or directory to be deleted through GET or something to the script, probably require urlencode() or something for that, make sure that it's an authorized user with permissions to delete trying to delete the stuff, and unlink() if it's a file, and Remove_Dir() if it's a directory.

You should have to prepend the full path to the directory or file to the directory/file in the script before removing the directory/file.

Some things you'll want for security is firstly making sure that the deletion is taking place in the place it's supposed to, so someone can't do ?dir=/ or something and attempt to delete the entire filesystem from root, which can probably be circumvented by prepending the appropriate path onto the input with something like $dir = '/home/user/public_html/directories/' . $_GET['dir'];, of course then they can potentially delete everything in that path, which means that you need to make sure that the user is authorized to do so.

Need to keep periodic backups of files just in case.

---

Something like this? Not tested...

<?php

   echo '`<a href="/Implementation/'.$Dept.'/'.$path.'">'.$file_or_dir.'</a> - [<a href=\"?thispage&del=1&file_or_dir=$file_or_dir\">Delete button/link</a>]<br/>`';  

?>

<?php

   if ($_GET['del'] == 1 && isset($_GET['file_or_dir']){
      unlink ("path/".$_GET['file_or_dir']);
   }

?>

---

I've worked it out:

I added this delete link on the end of each listed file in the original script:

- < a href="delete.php?file='.$file_or_dir.'&dir=' . $dir . '"> Delete< /a>< br/>';

This link takes me to the download script page, which looked like this:

<?php
ob_start();

$file = $_GET["file"];

$getDir = $_GET["dir"];

$dir = 'docs/' . $getDir . '';

$isFile = ($dir == "") ? 'docs/' . $file . '' : '' . $dir . '/' . $file . '';

if (is_file($isFile)){
if ($dir == "")
    unlink('docs/' . $file . '');
else
    unlink('' . $dir . '/' . $file . '');

echo '' . $file . ' deleted';
echo ' from ' . $dir . '';
}
else{
    rmdir('' . $dir . '/' . $file . '');
    echo '' . $dir . '/' . $file . ' deleted';}

header("Location: indexer.php?p=" . $getDir . "");
ob_flush();

?>

It all works brilliantly now, thank you all for your help and suggestions :)