PHP CMS: finding and replacing a pattern

willl

Hello,

I am building a new website and CMS in php for my insurance company and I have hit an obstacle..

I want to be able to include a custom php script for particular pages. (i.e. a quick quotation form) Our old CMS used a pattern for a script to recognise when searching through data pulled form a database and replace certain tags with different code. I want to use this tagging system to include a php file.

For example:

So this script I want to write will look for the curly braces, then everything before the hash will tell the script the type of include and after the hash will be the name of the particular php file I want to include.

I think I will have to use regular expressions and explode but I am still learning php and just want to see if anyone can suggest anything or point me in the right direction??

Thanks in advance!!

Will.

laserlight

You could try using [man]preg_match_all/man, e.g.,

<?php
$text = 'Hello {{app#form.php}}world{{fun#fact.txt}}   haha';
if (preg_match_all('/{{(.+?)#(.+?)}}/', $text, $matches, PREG_SET_ORDER)) {
    foreach ($matches as $match) {
        echo 'Include type: ' . $match[1] . '<br />',
             'Filename: ' . $match[2] . '<br /><br />';
    }
}
?>

This could be adapted for use with [man]preg_replace/man.

willl

Thanks for the helpful response laserlight.

I am just testing how I will include a php file and having problems. For example I use this:

$content = eregi_replace('{{[a-z0-9\.#]+}}', '<?php echo \'test\'; ?>', $content);

And the page simply displays <?php echo 'test'; ?> in it's place and doesn't include the file.

I realise I am trying to include the file too late in the process, can anyone tell me a way around this?

Thanks!

Will.

willl

I have found a solution, which means I use no reg exp's, using the eval() function:

hxxp://www.zimmertech.com/tutorials/php/51/evaluate-php-code-from-mysql. php

Can you find anything bad using this?

Thanks

laserlight

I realise I am trying to include the file too late in the process, can anyone tell me a way around this?

This depends on the design of your CMS. If you really want the user to actually include a PHP file, then why not just allow the user to modify the PHP code directly? More likely you want to identify these custom template tags and then replace it with some logical "files" stored in your database. These "files" will not be PHP scripts by themselves, but contain the user's content.

Can you find anything bad using this?

It no better than allowing the user direct access to the PHP script since it has the same security problems. It is probably also slower, though the difference may or may not be significant.

By the way, the ereg type of regex functions should not be used. Use the PCRE functions instead.