PHP code execution from within a mySQL field

motogp_fan

I'm building a content management system (CMS for fellow newbies) in which each page is called from the database. For example, http://www.site.com/content?id=about_us displays the About Us page. I'd like to be able to include another PHP document from within that About Us field. Currently the page comes up blank. I've tried encoding the field with addslashes(), htmlentities(), htmlspecialchars() but they return the actual PHP code with out executing it.

I've searched the manual and forum for clues but haven't found much. More overwhelmed with information overload and would sure appreciate some guidance.

Thanks!
MotoGP_Fan

mmilano

let me get this straight, .. you are storing php code inside your database?

if i'm correct, i don't think that is a very good idea. just query the text, and use those functions as you echo the code from the query.

pete_bisby

The "eval()" function will run PHP code. For example (taken from the PHP Manual)

$string = 'cup';
$name = 'coffee';
$str = 'This is a $string with my $name in it.<br>';
echo $str;
eval ("\$str = \"$str\";");
echo $str;

This example will produce:

This is a $string with my $name in it.
This is a cup with my coffee in it.

But I agree with mmilano .... it doesn't sound like a good idea .... it sounds a bit scary !!!

ravenlock

BAD idea. Very very bad.

Are you letting your users modify the PHP code? if so, why? I know it can be a bit of a challenge to write a flexible system that users can administer, but executing code like that is from the book of criminally insane ideas.

Unless you're the only one modifying the code, in which case it still makes more sense to just keep the php code in the code files and store a reference, something that will identify what the user is looking for, instead of the page itself.