How can I retrieve HTML/PHP code stored in a mySQL table and not have the PHP commented out?

Question

I am storing in a mySQL table the HTML/PHP content of individual slides to be displayed on a single page.

Here is an example of HTML/PHP code stored in the mySQL table:

<p>Welcome <?php echo $userData['fname']; ?>!</p>

<p>You made it to the first slide!</p>

I retrieve the content of the slides in PHP with the following code:

<?php 

$fetchedPageSlideData = mysql_query("SELECT * FROM pageSlides WHERE pageID = $pageID ORDER BY 'order' DESC") or die(mysql_error());

    while ($pageSlideData = mysql_fetch_array($fetchedPageSlideData)) {

        $pageSlideContent =  $pageSlideData['content']; ?>

        <div><?php echo $pageSlideContent; ?></div>

    <?php }

?>

All of the HTML of the content displays correctly, but the PHP is inserted as follows:

<!--?php echo $userData['fname']; ?-->

So the PHP is commented out and doesn't display.

How can I retrieve the HTML/PHP code and have the PHP not commented out?

What is the content of the database relevant to the code that has been inserted into the output HTML? — Tadeck
– Tadeck, Commented Nov 16, 2011 at 15:45
@ShaktiSingh: It depends on the specific case. But yes, it may be incorrect in this case. — Tadeck
– Tadeck, Commented Nov 16, 2011 at 15:46
I suspect that it is the code before and after your echo that is causing your code to be commented out. — Luke
– Luke, Commented Nov 16, 2011 at 15:46
@Tadeck The PHP outputs the user's first name. Is that what you were asking Tadeck? — Mark Rummel
– Mark Rummel, Commented Nov 16, 2011 at 15:47

Cooly · Accepted Answer · 2011-11-16 15:59:55Z

2

It might be a better idea to use placeholder strings in the DB data. Executing arbitrary php code from a DB can be dangerous. PHP is Evil

answered Nov 16, 2011 at 15:59

Cooly

1752 silver badges4 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Mark Rummel Over a year ago

Thanks! I'm looking into the use of placeholder strings. This might accomplish what I'm trying to do. Thanks again.

Cooly Over a year ago

A good place to start: stackoverflow.com/questions/828645/…

djdy · Accepted Answer · 2011-11-16 15:45:44Z

1

Look into PHP function eval(): http://php.net/manual/en/function.eval.php

answered Nov 16, 2011 at 15:45

djdy

6,9096 gold badges43 silver badges62 bronze badges

1 Comment

Mark Rummel Over a year ago

Thanks. I checked out eval(), but it looks like it has to be within PHP, which just gets commented out.

symcbean · Accepted Answer · 2011-11-16 16:43:46Z

Dropping in and out of the PHP interpreter makes your code rather difficult to read. Consider:

<?php 
    $f = mysql_query(
      "SELECT * 
        FROM pageSlides 
        WHERE pageID = $pageID 
        ORDER BY 'order' DESC"
      ) or die(mysql_error());

    while ($d = mysql_fetch_array($f)) {
       print "<div>" . $d['content'] . "</div>\n";
    }

Regardless there is no implicit nor explicit mechanism here which would inject the comment tags you've presented. However it may be the browser trying to make sense of the unescaped html code and <?php ... ?> tags.

Try:

 print "<div>" . htmlentities($d['content']) . "</div>\n";

As a side note, you might consider using

   print "<div>" . highlight_string($d['content']) . "</div>\n";

Or do you mean that you actually want to run the code stored in the database - if so, you're asking for a world of pain. Eval is not evil - but you really must know what you're doing to avoid getting bitten by it.

Collectives™ on Stack Overflow

How can I retrieve HTML/PHP code stored in a mySQL table and not have the PHP commented out?

3 Answers 3

2 Comments

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related