[RESOLVED] str_replace Modules Problem

[ds111]

Hey.

I have a little problem. I am allowing my users on the site to edit the sidebar and have variables like:

{module.loginform}
{module.username}
{module.sitename}

etc, etc. In the SQL Database, the code is there for each of them. When they submit the sidebar to the server, it saves it. It usually ends up being something like:

Welcome {module.username} to {module.sitename}!

I've made a little script that searchs in the database then takes the {modules} and replaces the code for them in the sidebar.
So in the end it SHOULD look like:

Welcome <?php echo $_SESSION['username']; ?>

Which should output:

Welcome, Test!

But, instead, it outputs as:

Test

Here's all the code related to sidebar:

$text in this case is: Welcome, {module.username}
$module_html in this case is: <?php echo $_SESSION['username']; ?>

<?php
class modules {

function findModules($text) {

	require_once('registry/loader.php');
	$loader = new loader;
	$loader->load("connect_db", "function");

	connect_db();
	$query = "SELECT * from modules";
	$run_query = mysql_query($query);
	$num_modules = mysql_num_rows($run_query); 			// Get the number of modules
	$i = 0;				// The index of how many modules we've replaced so far

	while($i != $num_modules) {
		$module_name = mysql_result($run_query, $i, "modname");		// ALWAYS in format: {module.XXXX}  Where XXXX is the module name
		$module_html = mysql_result($run_query, $i, "modhtml");


		$module_html = str_replace('<?php', '',$module_html); // Strip Open PHP Tags
		$module_html = str_replace('<?', '',$module_html); // Strip Open PHP Tags (Other type)

		$module_html = str_replace('?>', '',$module_html); // Strip Closed PHP Tags 

		$text = str_replace($module_name, $module_html, $text, $count);
		require_once('registry/functions/function.connect_db.php');

		$count = (int)$count;
		if($count != 0) {
			$text = eval($module_html);
			?>
			<script>
			alert("<?php echo $text; ?>");  //For debug purposes
			</script>
			<?php
		}

		$i++; // Increase amount of modules we've replaced
	}
	/* Done with replacing ALL modules recognized :: return the text*/
	return $text; 
}

}
?>

Code that calls it:

require_once('registry/functions/function.connect_db.php');
         connect_db();
         $query = "SELECT * from sidebar WHERE type='guest'";
         $run_query = mysql_query($query);
         $sidebar = mysql_result($run_query, 0, "html");
         require_once('registry/classes/class.modules.php');
         $modules = new modules;
         require_once('templates/'.$_SESSION['skin'].'/sidebar.php');

and in sidebar.php it just has <?php echo $sidebar; ?> embedded in some html code.

I hope I've explained it enough. Can anyone help?

If you dont understand what I've posted, please ask. Its a very simple concept but hard to communicate, so forgive me.

[ds111]

well, anyone know?

[laserlight]

This test script seems to work:

<?php
$text = 'Welcome, {module.username}';
$module_name = '{module.username}';
$module_html = '<?php echo $_SESSION[\'username\']; ?>';

$module_html = str_replace('<?php', '',$module_html); // Strip Open PHP Tags
$module_html = str_replace('<?', '',$module_html); // Strip Open PHP Tags (Other type)

$module_html = str_replace('?>', '',$module_html); // Strip Closed PHP Tags 

$text = str_replace($module_name, $module_html, $text, $count);

echo htmlspecialchars($text);
?>

Consequently, the problem probably lies elsewhere, perhaps even in your input.

[ds111]

that outputs:
Welcome, echo $_SESSION['username'];

I am looking for:

Welcome, Test! (or whatever $_SESSION['username'] is)

look at function eval in php.net

i need to take the value of the eval into a variable
so something like

$test = eval($module_html);

But that doesnt work because it just evals it right away. I also tried:

eval("$test = eval($module_html)");

But that doesn't work either.

any other suggestions?

[ds111]

laserlight and i talked on MSN and this is the final code:

<?php
class modules {

function findModules($text) {

	require_once('registry/loader.php');
	$loader = new loader;
	$loader->load("connect_db", "function");

	connect_db();
	$query = "SELECT * from modules";
	$run_query = mysql_query($query);
	$num_modules = mysql_num_rows($run_query); 			// Get the number of modules
	$i = 0;				// The index of how many modules we've replaced so far

	while($i != $num_modules) {
		$module_name = mysql_result($run_query, $i, "modname");		// ALWAYS in format: {module.XXXX}  Where XXXX is the module name
		$module_code = mysql_result($run_query, $i, "modhtml");
		$type = mysql_result($run_query, $i, "type");

		$module_code = str_replace('<?php', '',$module_code); // Strip Open PHP Tags
		$module_code = str_replace('<?', '',$module_code); // Strip Open PHP Tags (Other type)

		$module_code = str_replace('?>', '',$module_code); // Strip Closed PHP Tags 

		$text = str_replace($module_name, $module_code, $text, $count);
		require_once('registry/functions/function.connect_db.php');

		$count = (int)$count;
		if($count != 0) {
			if($type == "php") {									// Is it PHP Code? If so, evaluate it.
				ob_start();
				eval($module_code);
				$thecode = ob_get_contents();
				ob_end_clean();
				$text = str_replace($module_code, $thecode, $text);

			}


		}

		$i++; // Increase amount of modules we've replaced
	}
	/* Done with replacing ALL modules recognized :: return the text*/
	return $text; 
}

}
?>