Remove PHP Code?

Stressed

I am wanting to take a template, remove any php code that could cause a security issue, and only parse specific tags I have in the template. The parsing of the tags I know how to do, I am wondering what the best way to remove the php code is. I want to parse the template then save it as a regular html file (unfortunately this file will have to be parsed by php for some of my secure code), but I dont want any other php code injected into it.

So to summarize, how can I remove PHP code from a template so it doesnt become executed when I save the output as an html file that needs to be parsed by php?

Thanks!

rehfeld

take a look at output buffering


ob_start();
include 'script.php'; // produces html
$output = ob_get_contents();

theres some other ob_* functions you may want to look at too...

Stressed

Originally posted by rehfeld
take a look at output buffering
ob_start();
include 'script.php'; // produces html
$output = ob_get_contents();
theres some other ob_* functions you may want to look at too... [/B]

How is that going to help, doesn't that just delay the processing of the code?

Like I said I have the need to do the following:

Take a template, and spit it out into a n executable php script, but I dont want the code in the template (if someone added some php code) to be executable. So lets say the template is like

I want the php stuff to not be processed at all. I don't want it processed when I process the template , or when it is sent to the final output code which will be parsed via php as well. I only want my custom tags (%%name%%) parsed by my code and thats it to keep people from adding insecure code or code to hack the server to the templates.

Thanks.

tsinka

Hi,

you can fetch the file content into a variable, remove the PHP stuff and then process your custom tags, something like:

<?PHP
$cnt = file_get_contents($strTemplateFile);
$content = preg_replace("§<\\?(php)?(.*?)\\?>§si","",$cnt);
// then process the custom tags
.....
.....
// finally print the content
echo $content;
?>

Thomas