Parse between the lines

[robertaccettura]

I've got a form that a user can fill out Say the user inputs something like this:

This is some text.  We can execute PHP
[execute]
//Here is some php
for($i=0;$i++;$i<10){
  print "This is ".$i;
}
[/execute]
Ok, that's enough for now.

HTML <b>is</b> valid too. Right?
[execute]
// note we preserve variables and stuff from above.

if ($i == 10){
  print "Yes";
} else {
  print "Wrong";
}
[/execute]

What I'm interested in is a method to parse what's between the [execute] and [/execute] tags, and print the output in that spot.

As the above exmaple notes, it should preserve variables as well.

Can anyone provide some insight/sample/whatever else may help?

[Weedpacket]

Replace [execute] with <?php and [/execute] with ?>, stick a ?> on the very beginning (so that PHP knows not to try treating everything as PHP right from the get-go), and then eval() the whole lot. Something like that, anyway.

Be warned, though, that this idea of yours is VERY RISKY. People will be able to do anything to your system that PHP can do. Think about that for a bit.

[robertaccettura]

Well, whomever has access, has shell access.

Most likely, the code will be in text file on the server... written via pico or vi. So no more insecure.

I need to be able to use [execute][/execute] though. Adding PHP tags isn't really an option.

I also need the output to contain purely the output. Not any code, or [tags].

[Weedpacket]

Originally posted by robertaccettura
I need to be able to use [execute][/execute] though. Adding PHP tags isn't really an option.

I also need the output to contain purely the output. Not any code, or [tags].

What I described is what a script could do to achieve exactly that.

[jebster]

Weedpacket, some times you have to be a bit more direct 🙂

robertaccettura, what I think Weedpacket might is have your script use [man]str_replace[/man], [man]ereg_replace[/man], [man]eregi_replace[/man], or [man]preg_replace[/man] to replace [execute][/execute] with <?php ?> 😉