Executing PHP code from a DB?

jlambert

I'm having trouble getting PHP code to execute once brought out of a database. Here is the code I currently have.
<?

$query = "SELECT * FROM content WHERE content_name = \"$c\"";
$result = @($query,$dbcon) or die("Couldn't execute query");

echo "<center>$c</center> ";

while ($row = mysql_fetch_array($result))
{
$content_id = $row['content_id'];
$content_name = $row['content_name'];
$content = $row['content'];

$show_scon .= "

$content //<---this is where the code is stored but it doesn't execute. and if and when it does it comes out blank.

}

echo "$show_scon";

eojlin

Hi there,

I had a similar problem before, and up to now, I still don't know how to parse PHP code extracted from a DB field.

Anyway, I thought of a work around for this problem but I haven't tried it yet. How about, storing filenames of flat files that contain PHP snippets in your DB, and then including it inside your PHP script that requires your certain PHP code.

Do you get what I mean? Instead of storing your PHP snippets or code in $content you can try storing filenames of flatfiles. This means, you'll be writing PHP code in flat/text files. Then you may do a simple include call for it, like this:

include $content;

instead of doing echo "$show_scon"

well, it won't be as good as storing content in a DB, and you'll probably get bigger space requirements to your server, but it's the only promising way to do this (as of this moment).

goodluck, and tell me if it worked!

🙂

Anon

you can execute any code using
eval($code);
if you have html in $code, then close the parse mode first, like this:
eval("?>$code<?");

as for jeff, you fetch a record using

while ($row = mysql_fetch_array($result))

.. and then try to access it through associative keys:
$content_id = $row['content_id'];

if you want to do this, use mysql_fetch_assoc() instead.

regards, reptile

eojlin

wow! cool! i'll be trying that out ASAP...
thanks again reptile. maybe you're right, i just have to close the parse mode, 'cause i already tried using eval before and i failed (that's probably because i have my PHP code mixed up with HTML).

thanks again!

techek

If you want to be able to run PHP from a DB, you'll have to think of it in another way :

My idea :

<?php
// Get the relevant piece of PHP-code from DB
// Open up a textfile for writing
// Put your code into it
// Close the file
// REQUIRE the file
?>

If this doesn't work (I don't know if the file can be made AND required at the same time) you could perhaps redirect to the new script file using HEADER. But this last part is just a silly idea.

Question : Why do you want to be able to execute custom code-pieces and wouldn't that be a potential security-problem?

jlambert

MY reason for putting the code into a db is so that I just have one page called inde.php and I can call it like index.php?c=Index and it will go and get the Index page from the db. This way I have one file and can make an admin menu for the db.

eojlin

Yep! that's the reason why I also use this method. to create an easy to maintain template for the whole website.

btw, I tried reptile's suggestion, but I still can't make it work. I kept on getting errors from the eval() function.

Anon

you simply have to keep in mind that, unlike include() and require(), eval() stays in parse mode. the code you eval() must look as if it were the next line in your code.
try the following:

// this will work:
$code = 'print($var);';
eval($code);

note also the semicolon in $code. the syntax must be correct. now, if you want to eval() code that looks like a reqular .php file, i.e. it contains a start tag <? and end tag ?> and maybe some html, you'll have to insert an end tag before eval()ing:

// php/html mixed. will work, too:
$var = 'foo';
$code = '<?print($var);?>html';
eval('?>'.$code.'<?');

// won't work:
$var = 'foo';
$code = '<?print($var);?>html';
eval($code);

Anon

to Techek's idea:
why write the code to a text file first if you can just eval() it? you can really skip that part!

on the security problem you're talking about: i'd say it completely depends on who is authorised to submit code. i think you can't categorically call these things potential risks, it always depends on the context, i.e. on how good or bad your code and your security concept are. of course, you won't let any user submit php code via some form and execute it.

Anon

i'm sorry, there is a bold tag supposed to be visible around the 'html' in the example code:

// php/html mixed. will work, too:
$var = 'foo';
$code = '<?print($var);?>html';
eval('?>'.$code.'<?');

eojlin

Hi there!
thanks for the additional help... it really cleared my clouded thoughts. 🙂
now, I understand it better. btw, i'm still not done with this problem yet, but it's my problem. i have several functions that i'm using to catch the block of text from a DB. I guess eval()uating the string block and passing the string inside functions aren't possible. I might just trim down the unnecessary functions I made.
btw, i used those functions for aesthetics.

"eval() evaluates/parses the string immediately (when called) and doesn't result a parsed string. thus, passing eval()ed strings as parameters in functions won't work" ?!? (is this right?)

thanks again!

Anon

(well, what is a parsed string? you have a string containing code, and you can eval()/parse the code, which means executing it.
if you want to execute the code partially, you can pass on the string to a function, extract what you need, then execute it.)

if i get you right, you want to do something like

some_function(eval($my_code));

since eval() works like include() from a certain point of view (i.e. the "eval($code)" is just replaced by the code in the variable), this won't work. why not do the following:

eval($my_code); // $my_code contains "my_function()"
some_function(my_function());