eval()

[Surrix]

Ok I have a big question that is going to take a little explaining.

I have this code running though an eval function:

<table border=\"0\" width=\"697\" cellspacing=\"0\" cellpadding=\"0\" align=\"center\">
  <tr>
    <td width=\"100%\" align=\"center\" background=\"logo.jpg\" height=\"141\"></td>
  </tr>
  <table width=\"700\" align=\"center\">
  <tr>
    <td background=\"spacer.gif\"></td>
  </tr>
  </table>
  <tr bgcolor=\"Black\">
 <table border=\"0\" width=\"700\" align=\"center\">
      <tr>
        <td class=\"menuleft\">
        <a href=\"index.php\">main</a> |
        <a href=\"#\">articles</a> |
        <a href=\"#\">links</a> |
        <a href=\"http://www.patrickmcdaniel.net/forums/\">community</a> |
        <a href=\"#\">contact</a> |
        <a href=\"#\">about</a></td>
        <td class=\"menuright\">
        $today
        </td>
    </tr>
    </table>
  </tr>
  <table width=\"700\" align=\"center\">
  <tr>
   <td background=\"spacer.gif\"></td>
  </tr>
  </table>
</table>
<table border=\"0\" width=\"700\" align=\"center\">
  <tr>
    <td width=\"100%\" bgcolor=\"#F1F1F1\">
    <br> 

As you can see there is a php vairable in there. If before I called this in the eval function I had something like $today = date() would that show the date like I want it to?

The eval function I'm trying to run looks like this.

eval("\$index = \"".gettemplate('main_index')."\";"); 

And yes this is all coming out of the mysql database and my gettemplate function looks like this:

function gettemplate($templatename) {
//Get template from database
$template = mysql_query("SELECT template FROM template WHERE title = '".addslashes($templatename)."'") or
        die (mysql_error());
return $template ;
} 

[GameCrash]

As you can see there is a php vairable in there. If before I called this in the eval function I had something like $today = date() would that show the date like I want it to?

I think it should. Why don't you simply test it?

Oh, and you should add some kind of template cache to reduce the load if you have more than one template on your page...

[Stadler]

Try this:

function gettemplate($templatename,$slashes=1) {
  //Get template from database
  $template = mysql_query("SELECT template FROM template WHERE title = '".addslashes($templatename)."'") or
        die (mysql_error());
  return $slashes ? str_replace("\\'", "'", addslashes($template)) : $template;
} 

In if you want to make your eval-calls look better:

eval('$index = "'.gettemplate("main_index").'";'); 

HTH

Christian Stadler

[Cyborg from DH]

or just

str_replace('"', '\\"', $template) 

instead of adding and then removing some....

[Stadler]

mmh, I didn't know, that addslashes only works for quotes and not for backslashes itself ...

[Cyborg from DH]

whoops, my bad...

[Stadler]

well, my bad, too ... I haven't read www.php.net/addslashes correctly, so I thought, it only worked for quotes, then