eval for inline php code?

selfsimilar

I have inherited a script which pulls html from a mySQL database. The HTML includes some inline php code in the format <?php "..." ?>. Right now, in order to output this and maintain the inline php, I have inheritedthe following working code snippet:

eval('?' . '>' . $data);

where $data is my string of HTML with inline code.

I have two questions:

Why do "echo" and "print" both strip out the inline code.
What exactly is this simple little eval doing? It certainly doesn't feel like the question mark and Greater Than are acting as terneary or logical operators in this context.

Thanks

dalecosp

1. Why do "echo" and "print" both strip out the inline code.

What do you mean "strip out"? echo() and print() send HTML output to the browser, nothing more.

2. What exactly is this simple little eval doing? It certainly doesn't feel like the question mark and Greater Than are acting as terneary or logical operators in this context.

No, they aren't. If you look at [man]eval/man, you see it accepts one argument --- a string. The "period" is the concatenation operator. What this snippet actually seems to be doing is instructing the parser to close the PHP portion of the script (while still completing the eval() statement); therefore it allows the variable $data (which is not parsed by the current instance of the parser---no double quotes) to contain a mix of HTML and PHP code types. It's quite ingenious, I suppose ... if they'd written "eval("?>$data");" it wouldn't have worked, so they split the desired string value in 3 parts and concatenated it....

HTH,

selfsimilar

Thanks for the help. Luckily the script works as is, and I'm just trying to better my understanding of PHP instead of scabbling to make this work :-)

First, I'd like to get my head around why I can't use echo() or print(). Let me give this more context and hope this makes sense:

The variable $data is a string where the contents are mostly HTML but with some inline PHP code, as I said above. The contents of $data looks generally like this:

...</div>
<div class="ShowNotes"> (<?php CreatePopUpPhotoLink("/shows/flyers/20050218Metroposter.jpg", "poster", ""); ?>, <?php CreatePopUpPhotoLink("/shows/flyers/20050218Metroflyer.jpg", "flyer", ""); ?> )
</div>...

So when I say that echo() and print() "strip out" the php, it means that when I pass them the variable $data they will output:

...</div>
<div class="ShowNotes"> ( , )
</div>...

Or at least that's how it renders under a browser.

Then, with regard to eval(), I know that it just parses and evaluates a string. Where my confusion comes in is that when I say eval('?'.'>'.$data) I'm assuming that it's trying to evaluate essentially
"?>...</div>
<div class="ShowNotes"> (<?php CreatePopUpPhotoLink("/shows/flyers/20050218Metroposter.jpg", "poster", ""); ?>, <?php CreatePopUpPhotoLink("/shows/flyers/20050218Metroflyer.jpg", "flyer", ""); ?>
)
</div>..."

But somehow this gets passed to the browser just as if there had been an echo() or print() called. I would have thought I'd have to do something like eval('echo('.'?'.'>'.$data.')') in order to get this to output.

I'm obviously just confused, and I have a feeling it mostly has to do with single versus double quoting, but I'd love to understand this better.

Thanks so much

dalecosp

Well, we're getting a little complex ... check your error reporting settings and server logs, for starters.

As an example:

<?php

echo "This is a <div> tag and this is <?php echo "php code."; ?> and this is some more text.</div>";

?>

is parsed with errors.... while:

<?php
$foo="foovariable";

echo "This is a <div> tag and this is <?php echo $foo; ?> and this is some more text.";

?>

Should yield:

This is a <div> tag and this is <?php echo foovariable; ?> and this is some more text.

Finally, using eval, this, at the very least, should work:

<?php

$foo=12;
$bar=2;

$data= "<div> This is text <?php
echo 'that has been formatted in php together with a calcuation of 2 dozen eggs to 1 hundredth parts precision: ( '.number_format(($foo*$bar),2); ?>
) and also has HTML code </div>";

eval ('?'.'>'.$data);

?>

I'm offline for a while (at least browser wise while I upgrade my system today), but HTH and you get it figured soon.