Processing PHP stored in MySQL, again...

scrupul0us

basically i have an HTML form stored in MySQL.. within that html I have a php date call:

...
date("M d, Y");
...

now when I pull results from the DB:

<?=$row["data"];?>

When the html form comes up, instead of gettin the date I get:

date(

I tried wrapping the db var with eval() but that seems to kill the entire variable and nothing gets dumped... i tried wrapping the date code in php tags in the db but that doesnt work either

any ideas? thanks

laserlight

The problem is that:

date("M d, Y");

Does nothing to begin with. You should be using:

echo date("M d, Y");

That said, do you really need to store PHP code in the database? eval() should be avoided as far as possible.

scrupul0us

i did try echo... same results.... it just says: echo date(

and yes...in a few instances it is needed

laserlight

Suppose you have stored this PHP script in your database:

echo date("M d, Y");

Now, when you retrieve the script from the database:

<?php
// ...
eval($row['script'];
?>

scrupul0us

yup thats what i did... it returns just plain text 🙁

laserlight

Fascinating. Are you sure that the string contained is really 'echo date("M d, Y");'?

Another script to try:

<?php
$str = 'echo date("M d, Y");';
eval($str);
?>

What results do you get?

scrupul0us

if i do view source heres what i see:

<input class="fax_text" type="text" name="textfield" title="date" tabindex="6" value="echo date("M d, Y");">

which is alos how it looks stored in the db

scrupul0us

just tried:

wrapping the statement in php tags... no luck
using single quotes within date()... no luck

your test code succesfully returns the date

scrupul0us

but i go:

$str = '<input class="fax_text" type="text" name="textfield" title="date" tabindex="6" value="echo date("M d, Y");">';
eval($str);

i get nothing

DanielLiljeberg

A stupid way would be to create a function that saves your phpcode to a temp file, then includes it. That should execute the code. But that suck 😛

etully

I think the problem is that you are assuming that the eval() command will ignore HTML and just execute the PHP commands inside of it. That's not true. Really, the eval() command will run PHP commands. Therefore, if you want some HTML to come out of an eval statement, then you need to put print statements around the HTML just as you would if this were a PHP script.

The following works just fine for me:

<?
$str = 'print "<input class=\"fax_text\" type=\"text\" ';
$str .= 'name=\"textfield\" title=\"date\" tabindex=\"6\" ';
$str .= 'value=\""; echo date("M d, Y"); print "\">";';

// This is just a test to see what $str really looks like
print "$str\n\n\n";

// This is how $str evals
eval($str);

Therefore, the string should appear like this in your database:

print "<input class=\"fax_text\" type=\"text\" name=\"textfield\" title=\"date\" tabindex=\"6\" value=\""; echo date("M d, Y"); print "\">";

By the way, I think eval is extremely useful and would never say that it should be avoided. Like any tool, it's right for certain jobs. Use it when you absolutely have to have PHP in your database. (Which isn't all that often).

laserlight

Sorry about not getting back to you in this thread.

i get nothing

You need to set display_errors to On and set error_reporting to E_ALL in php.ini

Anyway, etully is right. If you had error_reporting on in the first place, you wouldnt have been confused. You would have received a parse error, since your eval() results in an attempted parsing of the script:

<?php
<input class="fax_text" type="text" name="textfield" title="date" tabindex="6" value="echo date("M d, Y");">
?>

The syntax problems are obvious now, arent they? So when developing PHP scripts, keep display_errors On and set error_reporting to E_ALL.

By the way, I think eval is extremely useful and would never say that it should be avoided. Like any tool, it's right for certain jobs. Use it when you absolutely have to have PHP in your database. (Which isn't all that often).

Well, eval() is used to parse scripts that are stored as data. The reason why eval() should be avoided is that user-supplied data is always suspect, so to begin with one should avoid storing PHP code for parsing by another script.

scrupul0us

yea i worked around it just about an hour ago... where I need dates I just use:

[longdate] or [shortdate] in the html and use ereg_replace on the $row variable when its processed and just swaps them out with date variables i define... cant beleive that took a day to figure out 😉

                <?php
                $longdate = date("F d, Y");
                $shortdate = date("m/j/y");
                $data = $row["data"];
                $data = ereg_replace("(\[shortdate\])",$shortdate, $data);
                $data = ereg_replace("(\[longdate\])",$longdate, $data);
                echo $data;
                ?>

ill have to edit my error_reporting when i get home.. thanks