Variable displayed instead of its value

bormuff98

I have a database that records incidents of network abuse and allows me to send different warnings to customers based on the type of network abuse that has occured. The warning is displayed in a form first to allow any changes to be made to it before being sent and includes some personalised info such as the IP address of the offending machine.

If I store the message body in a variable within the script I have no problems but I am trying to keep all the warnings in their own files and as a result the variable name seems to appear instead of its value in the form 🙁

The code I am using is as follows:

//Include hosts details
include('scripts/define_host_details.php');

//Open the correct warning file and load the contents into a variable
$filename = "warnings/omr1"; //kept simple for this query
$fd = fopen("$filename", "r");
$contents = fread($fd, filesize($filename));
fclose ($fd);

//Display HTML form
echo "
	...
	<textarea class='courier' name='msg' cols='72' rows='25'>$contents</textarea>
	...
";

This gives the output as:

Dear Sir.

It has been brought to our attention that the machine running on:

$ipAddr

is vulnerable to unauthorised third party relaying.

but should display the actual IP address. I tried doing this with the contents of the warning mail stored in a mySQL db but got the same results. I have a feeling I'm missing something very obvious 🙁 Could someone lindly enlighten me?

Weedpacket

Well, since it's just a piece of text, PHP has no reason to think that $contents contains any code. So, you'll have to explicitly tell PHP to treat it as code and evaluate it. Of course, it has to be modified slightly so that it is PHP code...

$variable='thingy';
$contents= 'This is a string with an embedded $variable in it.';
echo $contents."<br>"; // This is the string coming from the database.
$command = "echo \"$contents\";";
echo $command."<br>"; // This is the command PHP will be told to evaluate...
eval($command); // ...HERE.

The thing to remember is that the $command string has to be complete and correct PHP code (subject to things like properly escaping characters).

bormuff98

Thanks a lot, that has done the trick 🙂

Listed under "Miscellaneous Functions" in the manual, must remember to look there next time 😉

Weedpacket

Originally posted by bormuff98
Listed under "Miscellaneous Functions" in the manual, must remember to look there next time 😉

Well, where would you put it? 😃

Wow your colleagues with it - I did after building a dynamically configurable code templating system that was building entire sites on the fly, pulling HTML, content and PHP code out of the database to run it. After that little stunt the site deployment compiler was just a performance bonus.

That was a fun project.