Nested evals?

[–Michael]

In my StaticPageMod, I want to support PHP.

An admin can enter text into a textarea. When it is saved, the text is stored in the SMF's MySQL settings table.

With my mod, I retrieve the value from the settings table and set it into a php variable and display the content via echo.

Now, I want to support php, so far only text and HTML was possible, since I used echo.

For example, a user enters the following in the textarea (which will then be stored in MySQL):

Some plain text.<br>
<?php
echo "hello world";
?>

When doing an echo with this (echo $local_staticContent;), the PHP code is not executed well. No problem so far as we know that this is not the purpose of echo 


But in PHP, we have the eval function.

Code Select Expand

echo eval("?> " . $local_staticContent . " <?php");

But when using this code, the following error occurs:

Parse error: parse error in C:\Programme\XAMPP\xampp\htdocs\_mw\forum\Sources\Load.php(1040) : eval()'d code(18) : eval()'d code on line 79

I think this error occurs due to nested evals. Not sure. But load.php uses eval, too.

Do you have any suggestions?

Thanks,
Michael

P.S. I am not sure if this explanation was clear enough, please do not hesitate to ask me for further details 

[[Unknown]]

Well, first, you want this:

echo eval('?' . '>' . $local_staticContent);

But, yes, your error message indicates a nesting:

Parse error: parse error in C:\Programme\XAMPP\xampp\htdocs\_mw\forum\Sources\Load.php(1040) : eval()'d code(18) : eval()'d code on line 79

It says, "parse error in the code evaluated at line 18 by code evaluated at line 1040 of Load.php (which is probably a template file.)

In other words, check line 18 of your template file.  What it is evaluating, at line 79, has a parse error.

-[Unknown]

[–Michael]

Thanks, Unknown.

First, I thought nested evals are not allowed, and therefore this error occurred.

So I disabled the eval in the load.php by

INSERT INTO smf_settings VALUES('disableTemplateEval', '1');

Then I found out that I had positioned the spaces wrong:

Code Select Expand

echo eval("?> " . $local_staticContent . " <?php");

There must be a space *behind* <?php. So in this way it works:

Code Select Expand

echo eval("?>" . $local_staticContent . "<?php ");

Regards,
Michael

[[Unknown]]

You don't have to have the <?php at all.  I would, and always do, omit it.

-[Unknown]

[–Michael]

Yes but then I get a parse error message:

Parse error: parse error in C:\Programme\XAMPP\xampp\htdocs\_mw\forum\Sources\Load.php(1040) : eval()'d code(18) : eval()'d code on line 1

when using

Code Select Expand

echo eval($local_staticContent);

I think it's because $local_staticContent can contain both plain text and php code:

Some plain text.<br>
<?php
echo "hello world";
?>

[niko]

loop

normally put chars to $text if theres <?php start putting to $code when ?> $text .= eval($code); etc...

[–Michael]

Now I've implemented eval in my Static Page Mod.

Well, I have found out that it is better to use <?php and ?> like this:

Code Select Expand

echo eval(" ?".">" . $local_staticContent . "<"."?php ");

This was mentioned at php.net: http://de.php.net/manual/en/function.eval.php

Matt Flaherty
03-Jan-2003 05:48
With regard to the comments from Jan 8 and 9 2002, some problems may still occur that can be eliminated by adding whitespace as below:

eval (' ?>' . $string . '<?php ');

However it is important to realise that you must not comment out a line such as this. The delimiters will still be parsed, which would produce unexpected results and probably errors. Perhaps better to do something like this, which should have no trouble:

//eval (' ?' . '>' . $string . '<' . '?php ');

I can confirm this, in addition I also got error messages when I did *not* comment out that line.
But with this method it works fine.

Regards,
Michael

[[Unknown]]

Again, NOT this:

echo eval($local_staticContent);

And NOT this:

echo eval(" ?".">" . $local_staticContent . "<"."?php ");

I suggest this:

echo eval('?' . '>'. $local_staticContent);

Please note:
  - spaces are not necessary.  You don't need them, except after the <?php (which I don't suggest using.)
  - you need the closing of PHP, because it defaults enabled in an eval.
  - you DO NOT need to open it again, because it's not like copying it directly into the file or anything silly like that.
  - you should separate the ? and the > because some highlighters and some versions of PHP require this.

But, do it as you like.  My point is that you're not even testing the method I am suggesting.

-[Unknown]

[–Michael]

My apologies, I've overlooked this:

echo eval('?' . '>' . $local_staticContent);

In my current mod version, I am using this one now.

Regards,
Michael