如何检索存储在mySQL表中的HTML / PHP代码并且没有注释掉PHP？

Question

I am storing in a mySQL table the HTML/PHP content of individual slides to be displayed on a single page.

Here is an example of HTML/PHP code stored in the mySQL table:

<p>Welcome <?php echo $userData['fname']; ?>!</p>

<p>You made it to the first slide!</p>

I retrieve the content of the slides in PHP with the following code:

<?php 

$fetchedPageSlideData = mysql_query("SELECT * FROM pageSlides WHERE pageID = $pageID ORDER BY 'order' DESC") or die(mysql_error());

    while ($pageSlideData = mysql_fetch_array($fetchedPageSlideData)) {

        $pageSlideContent =  $pageSlideData['content']; ?>

        <div><?php echo $pageSlideContent; ?></div>

    <?php }

?>

All of the HTML of the content displays correctly, but the PHP is inserted as follows:

<!--?php echo $userData['fname']; ?-->

So the PHP is commented out and doesn't display.

How can I retrieve the HTML/PHP code and have the PHP not commented out?

Answer 1

It might be a better idea to use placeholder strings in the DB data. Executing arbitrary php code from a DB can be dangerous. PHP is Evil

Answer 2

查看PHP函数eval（）： http ： //php.net/manual/en/function.eval.php

Answer 3

Dropping in and out of the PHP interpreter makes your code rather difficult to read. Consider:

<?php 
    $f = mysql_query(
      "SELECT * 
        FROM pageSlides 
        WHERE pageID = $pageID 
        ORDER BY 'order' DESC"
      ) or die(mysql_error());

    while ($d = mysql_fetch_array($f)) {
       print "<div>" . $d['content'] . "</div>\n";
    }

Regardless there is no implicit nor explicit mechanism here which would inject the comment tags you've presented. However it may be the browser trying to make sense of the unescaped html code and <?php ... ?> tags.

Try:

 print "<div>" . htmlentities($d['content']) . "</div>\n";

As a side note, you might consider using

   print "<div>" . highlight_string($d['content']) . "</div>\n";

Or do you mean that you actually want to run the code stored in the database - if so, you're asking for a world of pain. Eval is not evil - but you really must know what you're doing to avoid getting bitten by it.