如何从MySQL数据库渲染PHP代码？

Question

I am creating some kind of custom CMS (home automation). Well I am not a PHP developer - just hobbyist.

What I am trying to achieve is:

In my index.php page I have something like:

"<?php echo $pageBody; ?>   "

PageBody I am fetching from Database, well it works well for HTML, JS. But it doesn't work with PHP code source.

I done some research I believe this is related to PHP security restrictions.

My question: Does anybody would be able to provide safe sample (cannot find any samples like this) - how I should do this.

I am trying to insert some php code and render it eventually via browser:

    <div id="outer">
        <div id="inner">
                    ***PHP Code should go here***       
        </div>
    </div>

At the minute - it is being rendered as text. However I can render properly HTML and JS.

My preferable way would be - as much as possible secure.

Many Thanks Guys!

Answer 1

When you retrieve PHP code from a database text field, the PHP interpreter does not "know" that it should parse the data as a PHP script. To the PHP interpreter, the data in that field is no different from any other data -- it is all strings without any special significance.

You could use eval ( docs ) to accomplish this if you're dealing with pure PHP scripts . Be forewarned: eval is considered "evil" because using it comes with risks, especially if your users will have any input as to the content of the database.

In your case, it sounds like you want to parse mixed PHP and HTML that is stored in a database field. In order to do this, you'd need to write the database data into a file, then include it so the PHP interpreter can do its thing. You should implement some kind of caching mechanism in this process, otherwise it might become heavy on your server with many users. You may also want to use output buffering ( docs ) to capture the output instead of immediately sending it out.

Briefly, you'd want to do something like this:

$content_from_db = "<h1>Hello <?php print 'Clarisse'; ?></h1>";
$identifier_from_db = '12'; // like the primary key from the table

$file_handle = fopen('cached_content/CACHE_'.$identifier_from_db.'.php', 'w');
fwrite($file_handle, $content_from_db);
fclose($file_handle);

// here is where you'd start output buffering, if you're going to do that (optional)

include('cached_content/CACHE_'.$identifier_from_db.'.php');

// and then here you retrieve the output buffer's content (optional)

Please note that this is not a "traditional" way of including dynamic content, and the above code is not production-ready . Without knowing your use case, I can't say for certain, but this idea of storing PHP code in the database is a rather unusual way to proceed.

Another alternative to rolling your own is the smarty template library. Check it out here: http://www.smarty.net . With smarty, you can write a resource plugin to pull the templates from the database. It would look something like the code above ( more info )

Documentation

• fwrite - http://php.net/manual/en/function.fwrite.php
• include - http://php.net/manual/en/function.include.php
• PHP basics on theopensourcery.com - http://theopensourcery.com/phpbasics.htm
• Server-side scripting on Wikipedia - http://en.wikipedia.org/wiki/Server-side_scripting
• eval - http://php.net/manual/en/function.eval.php
• Output Control (buffering) - http://php.net/manual/en/book.outcontrol.php
• Smarty - http://www.smarty.net

Answer 2

要执行存储在字符串（或数据库）中的PHP，可以使用eval函数 ，但请注意，这样做可能会有些危险。

Answer 3

You can't render (probably you mean execute) php code in the browser, because php scripts execute on the server and then the output is sent to the browser. By the time the browser recieve the response, script has already finished execution.

You can fetch the code from database and use eval() before sending the output. But you must be aware of drawbacks from this approach.

Answer 4

Browser cannot render (execute) PHP code. PHP is something that the server executes and sends to the browser as plain HTML to display.

For testing purposes you can download and install WAMP thats the most hassle free one stop solution for development.

link : http://www.wampserver.com/en/