I have a following question. I have put a long text (variable type LONGTEXT) into MYSQL database - through command line. Somewhere in this text there's a <br>
tag, and near the end of text there's <?php phpinfo(); ?>
. If i type SELECT * FROM mytable WHERE id=1
, this whole text shows as it is, so it is unaltered (read: both <br>
AND <?php phpinfo(); ?>
are there. But when I submit query via php like this:
if (mysql_num_rows($result) > 0) {
while($row = mysql_fetch_row($result)) {
echo $row[1];
}
}
Then the text is displayed exactly as I want it on my webpage, that means that <br>
tag is processed by the browser as newline, AND <?php phpinfo(); ?>
part is IGNORED. That is actually exactly what I want. But my question IS: WHY doesn't <?php phpinfo(); ?>
part get processed via browser?? Does the PHP's echo function ignore the <?php
tag??
Thanks in advance for explanations.
Because echoing a string is not the same as evaluating it.
PHP generates HTML, which is then processed by the browser. However a string containing PHP code won't be evaluated unless you specifically put it through eval()
(hint: DON'T!)
try this in a new empty browser window:
javascript:document.write('<b>hello <?php ?> is here!</b>');
Then open up firebug/inspector. In safari, the <?php ?>
thing seems to be interpreted as/converted to a comment.
PHP echoes anything you throw to it. If you want to execute the longtext, use eval
, if you want to properly display it, you could use the http://php.net/manual/en/function.htmlentities.php function for example.
Browsers don't process PHP. It is a server side technology.
Your PHP is reading some text from the database and outputting it to the browser. That the text includes the string <?php
is immaterial, it is output from the PHP programme, not part of the script.
When the browser parses it, it just looks like invalid HTML and it tries to perform error recovery (more or less ignoring it as an unrecognised tag).