Let's say you want to use Moodle to teach an introductory class in PHP
programming. Some of the students have little or no computer experience.
In addition to background reading and topics-oriented assignments
supplied by Moodle, you want to build an online text editor into the
course, so students can type their PHP programs and HTML directly into
files on the server, so they don't have to fight with NotePad on Windows
PCs in a lab, and so beginning students don't have to fight with FTP to
get their work onto the webserver.
You could make a form: (no error checking etc. for simplicity)
$path =
$_GET['dirpath']. '/myassignment';
echo '<form action="'.$_SER VER['PHP_SELF'].'" method="post">< br>
<textarea name="editor">' .@file_get_cont ents($path).'</textarea>
<input type="submit"></form>';
if($_SERVER['REQUEST_METHOD '] == 'POST')
{
$fp = fopen($path,"w" );
fwrite($fp,$_PO ST['editor']);
fclose($fp);
}
Most developers like to clean user input with addslashes or htmlentities
in the POST processing. But if you do that in the "online code editor"
case you get code that won't run or display. So, if you do not
addslashes, but you still want to cover your bases, what are the issues?
Students would have to login (password) to get access to the editor. So
this editor is not available to the world at large. But trusting
passworded students still may not be a good idea. fopen would have to be
limited to specific location patterns. Perhaps you would have to use
regular expressions to look for javascript, and then to strip it out.
But what do you do if you want to teach javascript? Is an online editor
any more dangerous than letting students upload code via FTP?
programming. Some of the students have little or no computer experience.
In addition to background reading and topics-oriented assignments
supplied by Moodle, you want to build an online text editor into the
course, so students can type their PHP programs and HTML directly into
files on the server, so they don't have to fight with NotePad on Windows
PCs in a lab, and so beginning students don't have to fight with FTP to
get their work onto the webserver.
You could make a form: (no error checking etc. for simplicity)
$path =
$_GET['dirpath']. '/myassignment';
echo '<form action="'.$_SER VER['PHP_SELF'].'" method="post">< br>
<textarea name="editor">' .@file_get_cont ents($path).'</textarea>
<input type="submit"></form>';
if($_SERVER['REQUEST_METHOD '] == 'POST')
{
$fp = fopen($path,"w" );
fwrite($fp,$_PO ST['editor']);
fclose($fp);
}
Most developers like to clean user input with addslashes or htmlentities
in the POST processing. But if you do that in the "online code editor"
case you get code that won't run or display. So, if you do not
addslashes, but you still want to cover your bases, what are the issues?
Students would have to login (password) to get access to the editor. So
this editor is not available to the world at large. But trusting
passworded students still may not be a good idea. fopen would have to be
limited to specific location patterns. Perhaps you would have to use
regular expressions to look for javascript, and then to strip it out.
But what do you do if you want to teach javascript? Is an online editor
any more dangerous than letting students upload code via FTP?
Comment