Question

I am storing in a mySQL table the HTML/PHP content of individual slides to be displayed on a single page.

Here is an example of HTML/PHP code stored in the mySQL table:

<p>Welcome <?php echo $userData['fname']; ?>!</p>

<p>You made it to the first slide!</p>

I retrieve the content of the slides in PHP with the following code:

<?php 

$fetchedPageSlideData = mysql_query("SELECT * FROM pageSlides WHERE pageID = $pageID ORDER BY 'order' DESC") or die(mysql_error());

    while ($pageSlideData = mysql_fetch_array($fetchedPageSlideData)) {

        $pageSlideContent =  $pageSlideData['content']; ?>

        <div><?php echo $pageSlideContent; ?></div>

    <?php }

?>

All of the HTML of the content displays correctly, but the PHP is inserted as follows:

<!--?php echo $userData['fname']; ?-->

So the PHP is commented out and doesn’t display.

How can I retrieve the HTML/PHP code and have the PHP not commented out?

Answer 1

It might be a better idea to use placeholder strings in the DB data. Executing arbitrary php code from a DB can be dangerous. PHP is Evil