PHP code in SQL displayed in page

Question

I want to be able to store PHP code in an SQL Database and display that whenever it is called. I don't want to use include and make loads of files. I want to be able to just put them all in SQL and call them when I want. How can I do this?

I have

$GETPAGE = "SELECT PA_CONTENT from pages where PA_NAME = '$page'";
$GETPAGE2= mysql_query($GETPAGE);
$GETPAGE3= mysql_fetch_array($GETPAGE2);
echo $GETPAGE3[PA_CONTENT];

but it echo's it out visible. Should I replace echo for something else?

Thanks

If you're using eval() as a substitute of include(),just to avoid using files, you should change your mind. And instead of eval() you might want to consider a templating engine, like Twig or Smarty — Damien Pirsy
– Damien Pirsy, Commented Feb 28, 2012 at 16:13

Surreal Dreams · Accepted Answer · 2012-02-28 16:10:52Z

2

You can use eval() to execute code that's in strings. Just make sure that you absolutely trust the code that's being run - it will run any PHP code it's given, so it could do malicious things if it's so instructed.

answered Feb 28, 2012 at 16:10

Surreal Dreams

26.4k4 gold badges49 silver badges61 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Richard Sparrow Over a year ago

Thanks Alot, shoulda kinda looked there first!

Surreal Dreams Over a year ago

The PHP Manual is a tremendous resource. Be sure to read the dire warnings about eval() - it could cause some serious problems, so think it through and make sure it's what you need.

Nanne · Accepted Answer · 2012-02-28 16:11:18Z

2

You can evaluate a string as code by using eval() http://php.net/manual/en/function.eval.php

BUT this is not recommended, see also the warning on that page:

The eval() language construct is very dangerous because it allows execution of arbitrary PHP code. Its use thus is discouraged. If you have carefully verified that there is no other option than to use this construct, pay special attention not to pass any user provided data into it without properly validating it beforehand.

answered Feb 28, 2012 at 16:11

Nanne

64.4k16 gold badges122 silver badges166 bronze badges

1 Comment

horatio Over a year ago

and "user-provided data" can mean "via previously stored SQL insert."

Collectives™ on Stack Overflow

PHP code in SQL displayed in page

2 Answers 2

2 Comments

1 Comment

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

1 Comment

Related