Evil Eval ()

redrabbit

Yea i know, but apparently this is bad and can make your ears turn green 🙁

Well, the question i was asking was, can you see a better way of doing an admin system.

At the minute, my index.php page does this:

loops through the database until the end is reached
Outputs all records in the proper format - using echo.

So you see it cant output a database record that countains: <?php echo "hello" ?>

Any other ideas

nemonoman

Why not:

$result=mysql_query("SELECT code FROM table");
while ($row=mysql_fetch_array($result)){
echo $row[0]; //doesn't matter if code is PHP or Fortran...
}
Are you trying to get items in <> to display in your browser? Is that your problem?

[man]htmlentities[/man]

echo htmlentities($row[0]);

Buddha443556

If you can't use eval(), why not output to a temp file and include it?

But I could be just confused. (It's my natural state.)

redrabbit

Im trying to get items in <?php ?> to display.

So i can do this:

<?php

  echo "<?php echo 'hello' ?>";

And it will output "hello".

I want to do this because my index page gets all its contents from a database. This allows me to update the page via a form - like an admin system.

nemonoman

Follow the Buddha's advice.

redrabbit

i heard eval () was evil ?

nemonoman

Would the Buddha suggest something evil? Maybe, but only for the long term good of your being. Eval is evil if you are not confident about what is being eval'ed. If you're eval()ing your own code, then you'll have only yourself to blame. If you're eval()ing code I submitted to your db, then look out, baby...I'm no buddha.

Buddha443556

Originally posted by redrabbit
i heard eval () was evil ?

No. Just make sure you validate and process the user supplied data. If you don't validate and process user supplied data then even an echo can come back and bite you in the butt.

redrabbit

Have you guys ever made an admin system for a website.

By admin system i mean where the user can:

edit content
add content
delete content

If you have, how did you achieve this ?

Buddha443556

Originally posted by redrabbit
Have you guys ever made an admin system for a website.

By admin system i mean where the user can:

edit content

add content

delete content

If you have, how did you achieve this ? [/B]

That would be a very long post.

If you want to know how it's done I would suggest heading over to Hotscripts.com and downloading some CMS or something more specialized ( might be easier to follow the code ). Load them up and start tinkering ( ohm...perferably on your own development server ). That's how I got started but that was back in the days when Assembly Language ruled. Good olde days my ass. 😉

swr

Originally posted by redrabbit
So i can do this:
<?php
echo "<?php echo 'hello' ?>";
?>
And it will output "hello".

That's exactly the kind of thing eval is for.

The reason it is potentially evil is because you need to be sure that what you're eval()ing isn't going to do something bad. If you trust the source to have access to your server, then okay, but if you don't trust the source there is really no way to make it safe.

Note that eval usually starts out in PHP mode, so if you have $code = "<?php echo 'hello' ?>"; then you'll probably want to eval like this: eval(" ?>".$code."<?php ");

SirIce

Originally posted by redrabbit
Have you guys ever made an admin system for a website.

By admin system i mean where the user can:

edit content

add content

delete content

If you have, how did you achieve this ? [/B]

Simple, you query the database, upload the data to the database, get the input from mysql_fetch_row and display 🙂