Returning php from database and rendering the code

Question

Im managing my web content a DB. When you hit a certian page, a query is made to the db to return the content for that page. Usualy I just store static html as a string and when it's returned from the db and placed into the webpage, it renders correctly. But now, some of the content actually contains php and when returned, the php is displayed as text. I looked in the eval() function but doesnt seem to work for me, or perhaps I'm using it wrong.

Here is and example of my code:

mysql_select_db("default_DB1", $con);

                $result = mysql_query("SELECT * FROM submenus WHERE active = '1' and menu_id='" . $_GET['article'] . "'");

    echo "<ul>\n";
                $counter = 1;
                while($row = mysql_fetch_array($result))
                {
                        echo "<li><a href=\"#tabs-" . $counter . "\" onclick=\"storySize('tabs-" . $counter . "');\">" . $row['submenu_name'] . "</a></li>\n";
                        $counter = $counter + 1;                    
                }
                echo "</ul>\n";

                $counter = 1;
                $result2 = mysql_query("SELECT * FROM submenus WHERE active = '1' AND menu_id='" . $_GET['article'] . "'");
                while($row2 = mysql_fetch_array($result2))
                {
                        echo "<div id=\"tabs-" . $counter . "\" style=\"height:100%; overflow:visible;\">" . str_replace("*#*","'",$row2['submenu_content']) . "</div>\n";                      
                        $counter = $counter + 1;
                }

                mysql_close($con);

Then the content returned is:

<table width="100%">
<tr>
<td align="right">Username: </td>
<td align="left"><input type="text" id="txtUsername" name="txtUsername" value=""></td>
</tr>
<tr>
<td align="right">Password: </td>
<td align="left"><input type="text" id="txtPassword" name="txtPassword" value=""></td>
</tr>
<tr>
<td>User Type</td><td><select id="ddlUserType" name="ddlUserType">

$con = mysql_connect("domain.com","username","pwd");
if (!$con)
  {
  die(#*#Could not connect: #*# . mysql_error());
  }

mysql_select_db("default_DB1", $con);

$result = mysql_query("SELECT * FROM user_types WHERE user_type_name <> #*#Admin#*# and active = #*#1#*#");

while($row = mysql_fetch_array($result))
  {
  echo "<option value=\"" . $row[#*#user_type_id#*#] . "\">" . $row[#*#user_type_name#*#] . "</option>";
  }

mysql_close($con);

</select></td>
</tr>
<tr>
<td align="right"></td>
<td align="left"><input type="button" id="txtReg" name="txtReg" value="Register" onclick="alert(*#*plaka*#*);"></td>
</tr>
</table>

"SELECT * FROM submenus WHERE active = '1' and menu_id='" . $_GET['article'] . "'" You should really reconsider this, since it is VERY insecure and dangerous to have code like this lying around. — DrColossos
– DrColossos, Commented Jun 30, 2010 at 17:38

ircmaxell · Accepted Answer · 2010-06-30 17:36:18Z

2

First off, look at eval. The reason I suspect it's not working, is that eval expects the code to start with php code (meaning it prepends an opening <?php. So it's trying to execute the HTML as php. To solve, simply prepend your code with ?> prior to feeding it into eval()...

Secondly, this is generally considered very bad practice. It makes it less secure (since a SQL Injection vulnerability can actually affect the server rather than just the data) and harder to maintain (since your code now lives in two places).

I would HIGHLY suggest finding another solution to your problem...

answered Jun 30, 2010 at 17:36

ircmaxell

166k36 gold badges269 silver badges316 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

David Radcliffe Over a year ago

I second this. Very bad idea.

Yo Momma Over a year ago

Cool. Thanks for the advice, I'll look into another method of doing it.

Collectives™ on Stack Overflow

Returning php from database and rendering the code

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related