Question

Good evening fellow overflowers, I’ve got a little problem that I’m attempting to solve but just cant and I’m hoping you can help.

I have a script that sends strings via cURL to a website. That behaves exactly as expected, and the webpage responds okay. My problem is that there’s a set of defines on the website that I want to tap into (for illustration purposes, example below:). I’ve already added a reference to the file where the defines are stored and this works like a charm.

define(‘TABLE_COUNTER’, ‘counter’);

Let’s say (all security and mumbo-jumbo aside) my script on the website I’m sending to has a simple:

mysql_query($_POST[‘aaa’]);

Where $_POST[‘aaa’] would be a valid query. If, on the website in question I were to do the following, the result would execute:

mysql_query("SELECT * FROM " . TABLE_COUNTER);

Which translates into:

mysql_query("SELECT * FROM counter");

However I cannot seem to get the script at the website end to execute any sqlquery with a constant defined. Any help would be greatly appreciated (I’m losing a lot of hair here!).

Thanks!

Answer 1

The way to do this is with eval:

$myquery_string = 'mysql_query('.$_POST['aaa'].');';
eval($myquery_string);

However, I don’t really recommend doing this, as it means that the form input can contain almost valid PHP code, and it will be executed by your script. This is worse than the typical SQL or XSS injection.

Also, when filling in the form, the user will have to include all the necessary quotes around the literal parts of the query.

A better solution would be to define a template language for your input, and have the PHP script replace template placeholders with the appropriate constants. But I’m not going to write this for you.