eval and databases

[Ford-p]

Hi,

I'm having problems eval'ing content from a mySQL DB.

This is for a CMS system I have which lets users add their own PHP to the pages, which is stored in the database.

Some example database content would be:

The date is <? echo(date()); ?>

I've tried many different eval methods, the only working being:

eval("?>".$value"<?");

The problem here is that it is automatically echo'ed.

My end result is:

ob_start();
eval("?>".$value"<?");
$string = ob_get_contents();
ob_end_clean();

However this is really inefficient and seems like too much of a hack.

Surely there has to be an easier way to store PHP (with tags) in a database (or a better way to do my CMS)?

Thanks

[NogDog]

As the (in)famous quote goes: "If eval() is the answer, you're probably asking the wrong question." I would therefore go with the "or a better way to do my CMS" option. 🙂 eval() is both inefficient and prone to security problems. I'd much rather see you stick to storing data in the database and PHP code in PHP files, and possibly [X]HTML text in separate template files.

Your database might then still be used for some of the control, but it would be limited to stating things like which function to call and perhaps a list of parameters to be passed to it, and perhaps reference to which template file to use, etc. But storing raw PHP code in the database and the eval()-ing it in your scripts is just asking for trouble, in my opinion.