[RESOLVED] Get PHP from DB

[thekidscareya]

I know I can create a table in MySQL and have it store html, but is it possible to store php?

Eg:
HTML

<?php
mysql_query("INSERT INTO table VALUES('', '<p>Hello</p>');");
$result = mysql_query("SELECT * FROM table WHERE `id` = '1'");
$row = mysql_fetch_array($result);

echo $row['html'];
?>

But if I put PHP into the table, do I include the <?php and ?> tags. When I tried it, it doesn't work.

[MarkR]

It is possible, but usually undesirable.

Having any code which could possibly be modified by the users opens up a possible privilege escalation vulnerability.

Mark

[SV1]

I'm trying to update from content in files to storing page content in a DB and I too was just pondering the same thought of storing some php tags that I have mixed in with my content pages. I've been using

<?php echo $siteurl;?>

for all of my links and images within my content incase it needed to be moved but after writing the insert and display page and figuring out how to link everything (which I understand better now after a week of fooling about) the php tags are returned as percents and are obscured.

I understand the reasons to not put php in the DB, now should I just do a virtual path like

<img src="../../images/foobar.png">

from the location of the script page or??? I'm not a fan of virtual linking, which is why I went the php route to begin with it was the perfect solution until now.

[SV1]

I've managed to make all paths work from the root. Second best but it works.