Currently I am working on a project in which I have to save some PHP code in database, I am saving the code with PHP tags.
But I am not getting how I can retrieve the code exactly as stored into database.
I have tried the following methods :
a) Direct retrieval : When I am retrieving the databse directly then the value of $row['code'] is blank
b) using eval() : When I am using eval() then I am getting syntax error :
syntax error, unexpected '<' in H:\xampp\htdocs\trycodeonline\testing.php(27) : eval()'d code on line 1
c) using eval() without php tags : when I am removing the php codes then I am getting result instead of code, like I want to print echo "hello" but it is printing "hello"
So how can I print the php code ?
If you really want to do it, you can use eval() as your method c) suggests:
$var // your variable with the data from the DB
<?php echo eval("?>". $var ."<?") ?>
There are many legitimate use-cases where you'll want to store PHP commands in a database, and I personally find shouting "dont do it" without knowing the circumstances a bit unhelpful.
Anyway, as has already been pointed out in various threads, there are security issues and other pitfalls using this approach and I would recommend against it. It will make debugging harder, and increases potential security vulnerabilities, and so on...
Read this post and this post to know more about the pitfalls of using eval().
Convert any non alphanumeric character to HTML equivalent (i.e whitespace to ) then store it in your database. Then your query can straight outta wood use it in the View.
highlight_string strings works fine
$str=highlight_string('<?php
echo "hello";
?>',true);
echo $str;
But I am not getting how I can retrieve the code exactly as stored into database.
Well, if you're not able to do that, please ask a database question (please after you've taken a PHP and database programming course). Because unless this works, the rest is a total different story anyway.