Jump to content

Liquidz0r

New Members
 View Profile  See their activity

  • Posts

    4

  • Joined

  • Last visited

    Never

 Content Type 

Posts posted by Liquidz0r

    HTML Mail with PHP injection

    in PHP Coding Help

    Posted

    Take a look at eval()

     

    Thank you soooooo much! I've been sending loads and loads of time on this. It was the only thing holding me back from actually completely finishing it. I tried everything I knew + google ... like searching the record, exploding it when defining custom tags for my strings etc etc but this is definately the key.

     

    I was getting really frustrated by this, you don't know how happy you made me just now + I learned a new php function which is definately a keeper.

     

    Again, thank you!

     

    Ohh yeah, my problem is solved because of this

    foreach() on $_POST help needed

    in PHP Coding Help

    Posted

    first of all, check your echo ... you're using $post instead of $_POST, so I imagine that might solve part of your problem.

     

    Secondly, what's the use of saying $_POST['wow2'] is not set ... when it's not set? Then you can't print/echo it either because there's just nothing there.

     

    Thirdly, you're writing an array-record inside an echo. I would do it like this:

     

    echo $_POST['wow2']." is set!<br/>";

OR

print("{$_POST['wow2']} is set!<br/>");

     

    then, your foreach function is pretty weird too ... you're trying to 'modify' your $value of your $_POST results I figure? There's no point storing them inside $_POST['$var'], try doing it this way instead:

     

    foreach($_POST as $var=>$value) {
$value = strip_tags(trim($value));
$value = mysqli_real_escape_string($con, $value);
echo $var." is = ".$value." !!<br/>";
}
}

     

    Something like that, I'm at work so I didn't check it myself :-)

    HTML Mail with PHP injection

    in PHP Coding Help

    Posted

    The short tags aren't the problem. I tried it with echo $string too and I'm using short tags in other parts of the website too and it works.

     

    The thing is, the page doesn't have an extension. the html-code is imported from a database into my website (temporary, for debugging ...) and is parsed through a php-script to combine it with content ... after that it gets mailed. Normally my website is just a system to mail the stuff to people.

     

    I'll add a printscreen:

    picture2igf.png

     

    Thing is ... I actually don't do anything with the html-code I fetch from the database ... I just fetch it and declare the variables (which are also mentioned in the html ... see my printscreen ( $test1 )) and I thought that would be enough to get the value out of those variables in my fetched html-code, but apparently something goes horribly wrong, where it seems that the code/server can't read the php-code I add to my html-template.

     

    Can someone give me a solution?

     

    P.S.: Yes, I know the html code in the end doesn't make sense but that's because I'm importing a template into an html atm, it's not relevant to this matter.

    HTML Mail with PHP injection

    in PHP Coding Help

    Posted

    I've been busy writing this mail for over 20mins but I just can't explain it properly I guess.

     

    My problem is inserting a php string into html code. The HTML-code is grabbed out of a database, so is the string. I'm making a php mailer system btw.

     

    I tried doing this earlier, but the problem I'm getting is that, when I add <?=$myString;?> to the HTML template (yes, the one from the database) and I send it through mail or print it on a webpage I won't get the value of $myString, but just $myString in pink-purple'ish letters (when viewing the source code in firefox ...) ... in other words, the little piece of php-code doesn't get recognized.

     

    Just to be clear ... I upload my template into the database already with the $strings I need to fill them up with content. The reason for this is because I'm building a dynamic mailersystem, if I would have only 1 contentfield there would be alternatives but I've been busy working on this the last couple of weeks and I don't see any other solution.

     

    So in short:

    I have a $string and <html>, both grabbed out of database, they're in seperate tables etc ... I just want to inject $string into <html> ... html already contains <?=$string;?> (for printing the value of the string) but it won't work when I send the mail (getting purple'ish text in source code with firefox ... kind of reminds me of a host which doesn't support php, gives same color to php).

     

    For the record:

     

    I'm using a function to grab my html file out of the database, I declare my $string in the same function and then just return the html (without really doing anything with it ... I thought that as long as the $string gets declared in the same function ... the html file will see it and fill the $string with its value.

     

     

    I'm sorry if it's really confusing, it's just not easy to explain I guess, easier when you're working with the code.

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.