Calling PHP variables from inside a MySQL Database

Question

I'm currently in the middle of working on a CMS system that builds the website straight from information saved in a MySQL database.

Here's the problem I'm having:

• Inside the CMS the user enters coding for a template
• the frontend of the site (frontend.php) calls the variable where the layout is stored ($template_header)
• The frontend also creates the variable $menu_code by pulling the menu code from the database, which was also stored via the CMS
• Inside of the template code, there has to be a break for this variable, when it is run by frontend.php it will be picked up.

This is what I've been trying:

inside frontend.php:

echo $template_header;

inside of $template_header:

<tr><td><center>'.$menu_code.'</center></td></tr>

What it should look like when frontend.php is run in the IE:

<tr><td><center><script>rest of menu coding in here</script></center></td></tr>

What it looks like when I do run it:

<tr><td><center>'.$menu_code.'</center></td></tr>

it displays it like text. It's probably a simple problem but any help would be much appreciated, on a tight deadline with this project and any advice would be greatly appreciated. Thanks

Answer 1

If I understand you correctly, it sounds like you want eval(), which will interpret a string as PHP code, meaning any reference to $menu_code will be treated as PHP, and not text.

From the manual:

<?php
  $string = 'cup';
  $name = 'coffee';
  $str = 'This is a $string with my $name in it.';
  echo $str. "\n";
  eval("\$str = \"$str\";");
  echo $str. "\n";
?>

Outputs the following

This is a $string with my $name in it.
This is a cup with my coffee in it.

Warning!!!!

As pointed out in the comments, this method (eval()) opens us a door for major security-issues. This method will evaluate arbitrary code, which can be very dangerous.

Answer 2

What you seem to be looking for is:

eval( $menu_code );

Answer 3

A simple replace would do the trick if I understand you correctly:

$template_data = "<tr><td><center>{%REPLACE_WITH_CONTENT%}</center></td></tr>";
$template_data = str_replace("{%REPLACE_WITH_CONTENT%}", $menu_code, $template_data);