Question

In my CMS I’ve added this code <div><?php include("my_contact_form.php") ?></div> which updates to a db. I can see it there OK.

I have this php code in my display page after the db call:

$content = $row['content']; 

when I echo $content inside the body this is displayed in the HTML source:

<div><?php include("my_contact_form.php") ?></div>

How could this possibly be? Why wouldn’t it show my contact form?
If anyone has any suggestions I would be extremely grateful.
Cheers.

Answer 1

The simple solution is to run eval() on your content.

$content = $row['content'];

eval("?>".$content."<?php");

The closing PHP tag and opening PHP tag allow you to embed HTML and PHP into the eval() statement.

About the choice of storing your PHP and the DB vs Files.

Assuming you’re goal is to have PHP that can be edited by admins from an interface, and executed by your server.

You have two choices:

Write the PHP to files, and include or exec() the files.
Write the PHP to the DB, and exec() or cache the content to files and include().

If you’re on a dedicated or VPS server, then writing to files is the best choice.
However, if you’re on a shared hosting system, then writing to DB is actually the safer choice. However, this comes with the task that you must use a very safe system for querying the database, to eliminated all SQL injection possibility.

The reason the DB is safer in a shared environment is due to the fact that you’ll need write access for the PHP process to the PHP files. Unfortunately, on “every” shared hosting setup, the same PHP user runs on each account and thus has write access to the same PHP files. So a malicious user just has to sign up for hosting and land on the same physical machine as you, or exploit a different account to gain access to yours.

With saving the PHP in mysql, PHP cannot write to the mysql files since it doesn’t have the privileges. So you end up with more secure code, if you eliminate the possibility of SQL injection. Note that if you have an SQL injection vulnerability with write ability, then you have also opened a remote code execution vulnerability.

---

Edit:

Sorry the correct syntax is:

eval("\r\n?>\r\n ".$php."\r\n<?php\r\n");

Thats been tested quite intensively to work on every PHP configuration/setup.