[RESOLVED] Getting "embedded code out of Variable"

pkrk

I have a PHP string variable that has php commands with mysql commands in it, how do i get those out to "run".

like in the section of code below
the variable $pleasework has commands that work when put in a php file alone, but the way it appears below it just prints it on the screen as text, it doesnt get processed on the server side...

HELP PLEASE!!!!!!!!!!!!!!

if it means anything the text(php commands) where inserted into hiddenordercode using javascript and a hidden input tag.

if($_POST['UpdateOrder'])
{

$pleasework = stripcslashes($_POST['hiddenOrderCode']);
echo $pleasework;

}

thank you

bpat1434

umm... in order to get stuff to run you either need to do [man]exec/man or create a function and call the variable function $pleasework() ... although if this is all off user-input, I'd suggest you NOT do that as it's a huge security risk.

pkrk

thanks for your input and quick reply,,,, I just got it to work with

eval($pleasework);

the input is never entered by the user,,, just off the select boxes the user selects.

Weedpacket

pkrk wrote:
the input is never entered by the user,,, just off the select boxes the user selects.

Um, that sounds like user input. I think it would be a really good idea to change this. At least let us see what these select boxes are like, and what the values they submit to the server are. Because if what you're doing is anything even remotely what it sounds like you're doing then it is Very Very Bad.

bpat1434

pkrk: You do know that users have the ability to change the value of the select boxes right? So even though it's hard-coded into the HTML, they can change the value to be something else.

One thing you could do that would be more secure (although still not a good idea) is to use keywords and a switch statement. The checkbox values would be nothing more than mere keywords or even integers. Then in PHP, you'd clean the values meaning that if you expect an integer, you cast it to be an integer and do a switch statement like:

$keyword = $_POST['something'];

switch($keyword)
{
    case 'keyword1':
    case 1:
        $command = 'some weird command...';
    break;

case 'keyword2':
case 2:
    $command = 'some other command....';
break;

default:
    $command = 'something else...';
break;
}

exec($command);

pkrk

Hey guys,

below is the -form- if one was to view source of the page, maybe I didnt mean to say "select box"?... let me know if there is a way to change the text in those "select boxes" as you say, i thought since the user isnt typing in, that they can't mess around too easily.

thanks,
pkrk

<body>

<form action=" ..............." method="post" enctype="application/x-www-form-urlencoded" name="OptSelVal" id="formA"><input type="hidden" name="PHPSESSID" value="ec93d062087fe697c87e95536196b1fb" />
Date Article<br />

<select name = "UpOption" size="7" id = "UpOptionID" multiple >

<option value='135 'selected>11-08-07 vvvvvvvvvvvvvvvvvvvv</option> <option value='177 '>11-21-07 ccccc</option> <option value='137 '>11-12-07 aaaaa</option> <option value='158 '>01-06-07 2gggggggggggggggggggggggg</option> <option value='173 '>11-17-07 hhhhhhhhhhhhhhhhhhhhhhhhhh</option> </select>
<br />
<br />
<td><input type ="submit" name = "Retrieve" value ="Edit">
<input type ="submit" name = "Delete" value ="Delete">

<input type="button" VALUE="&nbsp;Up&nbsp;" onClick="moveOptionUp(this.form['UpOption'])">
<BR><BR>
<input type="button" VALUE="Down" onClick="moveOptionDown(this.form['UpOption'])">
<BR><BR>

</td>
    	 </form> 

    </div>

Weedpacket

pkrk wrote:
i thought since the user isnt typing in, that they can't mess around too easily.

Actually it's trivially easy. Anyone with the faintest intention of submitting bad data could send anything they like: at one extreme they could construct a whole different form with their choice of fields, and at the other - right now there are select boxes on this page: I can turn them all into text boxes with two mouseclicks (Firefox's webdeveloper toolbar). I can also make those hidden fields visible and editable. Never trust anything from the client.

But it does look like there's more to your eval than just what you've intimated ("173 " won't do much on its own), so you have the opportunity to sanitise the data (make sure that it is a number in the appropriate range, for example). But still, the short answer (as Rasmus Lerdorf put it), is that "If eval() is the answer, you're almost certainly asking the wrong question".

pkrk

thanks for the advice i have to run this by the man in charge -