Hi All,

 

I am currently building my own CMS to convert my static website to be dynamic, but i have come aross a problem.

 

i have inputted HTML data which contains php into my database using a form i have built.

 

But when i echo the data back out, the HTML displays fine, but the PHP is displayed as RAW code....

 

for example, if i upload the following into my database, it echo's out exactly the same.

 

<?php require_once('connection.html');
mysql_select_db($ukfishe_fishery, $fishery);
$query_testimonial_SQL = "SELECT * FROM testimonial_tbl ORDER BY RAND( ) LIMIT 2 "; 
$query_testimonial = mysql_query($query_testimonial_SQL, $fishery) or die(mysql_error());
$query_testimonial_num_of_rows = mysql_num_rows($query_testimonial);
?>

 

Any help would be great

ok, php dose not work this way, the information collected from the database is not ment to have executable code in it, there is a work around function which i wont name because you DONT want to run code from the DB, lets say im mr hacker, i manage to inject the db with my own code via sql injection that changes the permissions of the file running the code with PHP_SELF then scans the current directory.

backs of to the root folder, then recursively scans the directory tree until there's one big multi dimensional numeric array listing all the files on your account, with a loop to do the same but in reverse using the information gathered in the array to use the @unlink(); function (delete)....

 

by one person seeing a hacked testimonial the server account running the code will be wiped.

 

what you want todo is possible, of course it is, look at facebook, but it's though Object Orientated Programming and not Procedural. with making websites dynamic, its not the code your making dynamic, its the content within, the php code is simply there to display and manipulate data how you see fit and not as a system to execute "dynamic" code.

 

also, if the connection.html actually lets your run php code then there is something up with your server settings and you should check it or ask your host why html files get run with php rather than just being sent out static by the web server (unless you have added the apache file type handler or similar yourself that is)

My first thought would be that you must have created a connection to the database already in order to pull that content out of a table, so why does your data have another connection in it?? That aside I have never tried pulling PHP from a database I tend to keep all my code in it's own files/arrays. It could either be something simple like an escaped character problem (are you using addslashes and stripslashes to store and retreive?), but I would have thought that is more likely a parsing problem. PHP will dump the data retreived into a variable and display it, it will then move on so the code you've pulled will never actually be read as PHP code - I could be wrong but that is what I would imagine without doing a bit more digging. The HTML parts will display as they are native to the DOM and hence dealt with on the client side.

 

I would recommend using an established CMS for your site anyway. I too went through a 'I'm going to build my own' phase and soon realised that the development and testing time followed by security implementation was killing my time to re-invent the wheel! There are loads out there to choose from that are open source GPL so you can hack away quite happily to tailor it to your needs, but you will be up and running with a working (and secure!) site much quicker.

 

Many of these also have built in support for 'pretty-urls' (answering your other post) as standard using either PHP or .htaccess depending on the CMS, so you could easily redirect your existing static domains without any loss of rank. I have been getting stuck into CMS Made Simple over the last week or so and have found it to be one of the most flexible and customisable of the half dozen or so that I have tried to date.

 

Failing that if you are going to code your own, you should maybe look at using a framework such as CodeIgniter. Lots of built in libraries means quicker development and simplified structure with great support for the security side of things. (plus someone else has done most of the hard work for you! - nice )

 

I hope this helps, in some way!?

My first thought would be that you must have created a connection to the database already in order to pull that content out of a table, so why does your data have another connection in it??

That is correct page.php connects to my db to grab the data, then the left column connects again to grab the testimonal data. i will edit the code to only make it connect once.

 

also, if the connection.html actually lets your run php code then there is something up with your server settings

My bad, it should be connection.php "thats what you get for copy and pasting and not paying attention"

Thanks for the advice,

 

When i create a new page via my CMS it gives it a URL of page.php?=[iD] this then goes and grabs the header, left column, right column, footer and content from my database.

 

Its the left column that contains the PHP code as well as HTML for my navigation. so i am not sure how i could get around this? maybe instead of calling the php from the database onto a PHP page, i will just have to include it on page.php to begin with?

yeah, what i do is somthing alone the lines of

 

// no validation but this is an example not a copy and paste
$page = $_GET['page'];

include('/home/account/pages/'.$page);

 

the include folder has access to all the code running prior to the include... this can be procedural function or a OOP class framework.