Processing PHP in a database

Question

I have a basic cms that stores pages in a table in a mysql database - is it possible for me to include PHP in a page and then have PHP process it rather than just output it as-is?

Ewan Todd · Accepted Answer · 2009-12-13 19:18:26Z

2

You can use eval (http://php.net/manual/en/function.eval.php)

But remember that eval is evil

edited Dec 13, 2009 at 19:18

Ewan Todd

7,33229 silver badges35 bronze badges

answered Dec 13, 2009 at 19:10

Nir Levy

4,7502 gold badges37 silver badges48 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Darrell Brogdon · Accepted Answer · 2009-12-13 19:06:45Z

1

I think you'd have to use eval() to do such a thing. So yeah, possible but not recommended.

answered Dec 13, 2009 at 19:06

Darrell Brogdon

6,99310 gold badges50 silver badges69 bronze badges

4 Comments

el joe Over a year ago

Can I ask what the security problems with this would be? (I am the only person who can add content to the database and I do this via phpmyadmin)

Darrell Brogdon Over a year ago

I think you would have more issues with performance than security. eval() is pretty expensive since PHP has to essentially spawn another interpreter for each call of eval().

wallyk Over a year ago

Also, that would be—at best—inconvenient to debug.

tstenner Over a year ago

Are you sure that you're the only one with access to the database? Using eval would turn a simple SQL-injection into a security nightmare.

Corey Ballou · Accepted Answer · 2009-12-13 19:14:43Z

As both suggestions have indicated, using eval() is not recommended and poses a serious security issue.

Your best bet would be to create a basic templating system. You could have a pre-determined set of PHP code blocks on the frontend which are triggered by certain key values on the backend, i.e. {show_categories} could be a tag that when parsed, gets replaced with all categories.

To implement such functionality you would have to search for the particular template key values. If any such key values are found, run the associated code with that key value and replace the key with the code.

A very basic example of finding and replacing a template key:

// check if the show_categories key is found
if (strpos($body, '{show_categories}') !== false) {
    // generate the show categories output from a PHP function
    $categories = getCategoriesOutput();
    // replace key with content 
    str_replace('{show_categories}', $categories, $body);
}

Collectives™ on Stack Overflow

Processing PHP in a database

3 Answers 3

Comments

4 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related