Member Avatar for chadlong41

I have got my database driven web site I m using

Code :

$query = "SELECT * FROM $sTableName WHERE ID=$inPageID LIMIT 1";
    $_CONTENT = mysql_fetch_array(mysql_query($query));

<?= $_CONTENT['PAGE_CONTENT'] ?>

to insert the content, into the page.

Now if I wanted to add a php command into the page (the part thats stored on the database) i m not sure what to do.

can someone help me out here?

Thanks !

  • 3 Contributors
  • 2 Replies
  • 88 Views
  • 10 Hours Discussion Span
  • Latest Post Latest Post by death_oclock

Dani AI

Generated

OP stored page content in the database and asked about embedding/running PHP inside that stored content. rightly reminded about proper PHP tags, and questioned whether the DB actually contains PHP that needs executing.

Storing executable PHP in the database is risky and hard to maintain. A better pattern is to keep content as HTML with placeholders and render it with a template engine or a simple, safe replacement step. This approach improves security, caching, and editing by non-developers. Example of a minimal placeholder render (safe escaping shown):

$content = $row['content_html']; // HTML with placeholders like {{username}}
$replacements = [
  '{{username}}' => htmlspecialchars($username, ENT_QUOTES, 'UTF-8'),
  '{{date}}' => date('Y-m-d'),
];
echo strtr($content, $replacements);

If executing PHP from the database is unavoidable and the editors are fully trusted, a pattern that captures output and evaluates the stored PHP can be used. This runs arbitrary code and must be heavily restricted and audited:

// only for trusted, reviewed content
ob_start();
eval('?>' . $contentFromDb);
$rendered = ob_get_clean();
echo $rendered;

eval() and include-like approaches carry high risk. Limit who can edit stored code, run thorough input validation, and prefer templating engines (Twig, etc.) for dynamic pages. See the PHP manual for details on eval(): eval() - Manual.

Recommended Answers

All 2 Replies

Member Avatar for Member #120589

Now if I wanted to add a php command into the page (the part thats stored on the database) i m not sure what to do.

Sorry, don't follow you.
Any php should be tagged:

<?php
echo "Hello World!";
?>

There are some decent tutorials online, have a go yourself first.

Member Avatar for death_oclock

Using <?= is shorthand for printing whatever is between the tags. I don't understand your problem, however. Do you have PHP code stored in a database that you would want to execute?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.