PHP syntax displaying in HTML source

Question

Hi all, In my CMS I've added this code <div><?php include("my_contact_form.php") ?></div> which updates to a db. I can see it there OK.

I have this php code in my display page after the db call:

$content = $row['content'];

when I echo $content inside the body this is displayed in the HTML source:

<div><?php include("my_contact_form.php") ?></div>

How could this possibly be? Why wouldn't it show my contact form? If anyone has any suggestions I would be extremely grateful. Cheers.

Answer 1

You're echoing $content, that just prints out the value, but it doesn't execute any PHP within it.

Answer 2

It sounds like you are storing the PHP code in the database and expecting it to be executed when you echo it. This won't happen, as far as the PHP interpreter is concerned it's just text (not PHP code) so it will just echo it.

You can force PHP to interpret (/run) the code in your string with the eval() function, but that comes with a large number of security warnings.

Storing code in the database is rarely the right solution.

Answer 3

Use <?php include("my_contact_form.php"); ?> without the <div>...</div> tag.

Please Notice that I include an semi-colon(;) after the closing parentheses.

Answer 4

The simple solution is to run eval() on your content.

$content = $row['content'];

eval("?>".$content."<?php");

The closing PHP tag and opening PHP tag allow you to embed HTML and PHP into the eval() statement.

About the choice of storing your PHP and the DB vs Files.

Assuming you're goal is to have PHP that can be edited by admins from an interface, and executed by your server.

You have two choices:

Write the PHP to files, and include or exec() the files. Write the PHP to the DB, and exec() or cache the content to files and include().

If you're on a dedicated or VPS server, then writing to files is the best choice. However, if you're on a shared hosting system, then writing to DB is actually the safer choice. However, this comes with the task that you must use a very safe system for querying the database, to eliminated all SQL injection possibility.

The reason the DB is safer in a shared environment is due to the fact that you'll need write access for the PHP process to the PHP files. Unfortunately, on "every" shared hosting setup, the same PHP user runs on each account and thus has write access to the same PHP files. So a malicious user just has to sign up for hosting and land on the same physical machine as you, or exploit a different account to gain access to yours.

With saving the PHP in mysql, PHP cannot write to the mysql files since it doesn't have the privileges. So you end up with more secure code, if you eliminate the possibility of SQL injection. Note that if you have an SQL injection vulnerability with write ability, then you have also opened a remote code execution vulnerability.

---

Edit:

Sorry the correct syntax is:

eval("\r\n?>\r\n ".$php."\r\n<?php\r\n");

Thats been tested quite intensively to work on every PHP configuration/setup.

Answer 5

If you're using an existing CMS, like Joomla, Drupal, etc.
The CMS is handling the text from the DB as what it is - text. It won't execute the text, it's probably just pulling it as a string from the DB and echoing it onto the page. See Brenton Alker's answer for a better explaination.

If possible, it would be better to work within the functionality of the CMS, and avoid hacking your CMS's source to use eval(). Depending which CMS you're using, there may be a feature (ie: a button in your editor, or similar) to include code from another file.

Or perhaps there's a feature to create "objects", "modules", whatever-they-wanted-to-call-them, which would allow you to place the code (as HTML) that you're trying to include into an "object", stored in the DB, allowing you to include it in numerous pages. This would attain the same goals as doing an include() in PHP (code reuse, avoiding duplicates, making changes in one place, etc.) but it would also save you having to hack the CMS or start risking security.

If you've built your own CMS
You may want to build such a feature in. It all depends on your needs, and how important security is.

Ultimately if you use eval(), and if anyone hacks either:

• Your DB
• Your CMS's admin interface

then they will be able to execute any PHP code on your server. And if you have exec() enabled in your php.ini (which is not safe), then they will also be able to run any code they want on your server itself... eeek!

Answer 6

Thanks for this - simple solutions are the best for me! Thanks for the extra info too. Sadly eval() as you suggest it didn't work for me here. So, plan C, I've decided to create a selectable tinymce template that has an iframe which calls the contact_form page and all the processing happens in the iframe. This works. Thanks everyone!