DB field whose value is PHP/mySQL code

PHP
1

Pretty general question here…

If I have a table that has a field whose value is PHP/mySQL code, what do I need to do/techniques to use to make sure that the code block is interpreted by the server before output is made to the browser window?

2

I think you do…

  1. Get the row from a Query in PHP
  2. Before outputting the row, run an eval()

More here –> eval()

3

Excellent :slight_smile:

One other thing that I’m quite curious in learning about more which is sort of semi-related…

When I come across code that’s basically a name wrapped in curly braces (i.e. {element name}), generally speaking, what are the steps involved to replace that with the intended content?

4

The better way is not to have a table that has a field whose value is PHP/mySQL code and keep code separated from data

5

But what if you’d like to be presented with the ability of editing snippets of code via a CMS as opposed to a text editor? Is the convenience that that may provide superceded by the fact this is universally bad design practise?

6

it isn’t “universally bad design practice”

of course you can store code snippets in mysql – use VARCHAR and you’re good to go

7

Cool :slight_smile:

Can someone please shed some light on my other query (http://www.sitepoint.com/forums/showpost.php?p=4503761&postcount=3)?

8

this is universally bad design practise

exactly it is.
You have to consider if you really need your snippets.

9

no it isn’t

10

Anyone please? :slight_smile:

One other thing that I’m quite curious in learning about more which is sort of semi-related…

When I come across code that’s basically a name wrapped in curly braces (i.e. {element name}), generally speaking, what are the steps involved to replace that with the intended content?

I don’t need the steps to be technical, but a (very) general run through.

11

It’s poor design.
It’s serious security risk
It’s debugging hell
It’s performance fault.
Don’t say it isn’t universally bad design practice.

12

Take a look at [fphp]str_replace[/fphp]. :slight_smile:


$template = 'Hello, {{firstname}} {{lastname}}, welcome back!';

foreach(array('firstname' => 'Anthony', 'lastname' => 'Sterling') as $token => $value){
    $template = str_replace(sprintf('{{%s}}', $token), $value, $template);
}

echo $template; #Hello, Anthony Sterling, welcome back!
13

Thanks for the reply :slight_smile:

That’s sort of what I thought the ‘solution’ would be.

Hypothetically speaking though, how could we achieve (if at all) the same results if there was no $template variable?

echo 'Hello, {{firstname}} {{lastname}}, welcome back!';

I’m thinking there isn’t any way other than to replace the curly braced element names with functions. Please correct me if I’m wrong :slight_smile:

14

Hypothetically (;)), why would you not want a variable?

15

you’re a nice guy, but what you posted is wrong

and i will continue to say that storing code snippets in a cms is ~not~ “universally bad”

16

Touche :smiley:

17

How do you think forum software like vBulletin store code quoted in forum posts?

18

I suspect that he was intending to mean software code that will be used as a part of the system in production. So instead of having code in PHP files, parts of the code will be stored in the database, and later on evaluated as a part of the live running code.

19

what about code modules that are selectively combined and then compiled, to provide customized application executables