Storing PHP in a DB?

Inkybro

Hello everyone. I've been trying to implement a small idea into my game, instead of using if thens for every item possible I decided to add a field to the DB called action, and it contains the code required to "Use the Item". I am using eval but can't seem to get this to work, any help would be greatly appreciated.

useitem.php:

<table width=100% cellspacing=3 border=0>
<tr><td width=100% colspan=2 align=center>
<table width=100% cellspacing=1 cellpadding=1 bgcolor=black border=0>
<tr><td bgcolor=#<? echo $q103['header_c']; ?> align=center><b>Use an Item</b>
<tr><td bgcolor=white>

<?php

$q1 = mysql_query("select * from items where id='".$iid."'");
$q2 = mysql_fetch_assoc($q1);

eval(stripslashes($q2['action']));

?>

<center><h3>Item used!</h3><a href="index.php?page=inventory">Back to Inventory</a></center>

</table>

Code stored in the action field for a health potion:

mysql_query("update characters set hitpoints=hitpoints+'100' where c_owner='".$_SESSION['l_username']."'");
echo mysql_error();

$yourhp = mysql_fetch_assoc(mysql_query("select * from characters where c_owner='".$_SESSION['l_username']."'"));
echo $yourhp['hitpoints'];

ERROR:
Yeah, this is the funny part. Nope, no error. It's like it's not parsing the code in the action field either because it won't display the cariable at the end of the code, $yourhp['hitpoints'].

This is a huge problem so any help is awesome, thanks in advance!

EDIT: I've tried the Eval with and without stripslashes. Yes I checked the Session variable and I have checked that all the fields match the ones in the code too.

tsinka

Hi,

in this case you might need to replace
$yourhp by \$yourhp in the code you want to eval.

Or generally spoken:

Without the backslash PHP tries to replace any variable without \$ before eval is executed on the string.

Thomas

Inkybro

Thanks for your help, but unfortuantely it did not work! I tried this:

mysql_query("update characters set hitpoints=hitpoints+'100' where c_owner='".\$_SESSION['l_username']."'");
echo mysql_error();

\$yourhp = mysql_fetch_assoc(mysql_query("select * from characters where c_owner='".\$_SESSION['l_username']."'"));
echo \$yourhp['hitpoints'];

It's still leaving it blank, and I'm starting to get frustrated because I need this to work. Is there anything else I could give everyone to help you determine the problem and solution? Any more ideas? Thanks again.

EDIT: It took out the backslashes, but they're in there. I put one in front of every $, do I need to put them behind or just in front? Example: '".\$_SESSION['l_username']."'.

tsinka

Ok,

put ini_set("error_reporting",E_ALL);

on top of the script and check for any warnings/errors and echo the code you want to eval just in front of the eval(...) line.

Thomas