Posted by Erwin Moller on 09/15/06 09:15

Chris Hope wrote:

> jds5@xtra.co.nz wrote:
>
>> Hi There,
>> I am absolutly stumped by this, any help appreciated.
>> Due to factors outside of my control I have a php variable containing
>> php code and I dont know how to evaluate it.
>>
>> I know its stupid, but php calls a database function (which I dont
>> have access to) which reads in a template html file and returns it as
>> a string. Now If I want the template to be a bit more dynamic and
>> contain php I have a problem.
>>
>> After calling the database function I end up with: (examaple only)
>> $var = "<?echo "hello world";?>";
>> //$var is now equal to the template file - usually html but attempting
>> to add php
>>
>> now if I echo that out I get:
>> <?echo "hello world";?>
>> but I want:
>> hello world
>>
>> Can I call another instance of the php interpreter on php variable
>> $var?
>> Would the eval() function work?
>>
>> Any way to acheive what I am after?
>
> Use eval() - did you try it? Note that you don't need the <? and ?>
> tags. Example:
>
> $var = 'echo "hello world";';
> eval($var);
>
> This will display 'hello world' which is what you are wanting.
>


Also, if you start evalling values from the database, be VERY sure you can
trust them.
If they come from userinput (forms for example) they can contain anything.
Be paranoid.

Regards,
Erwin Moller

[Back to original message]