[SOLVED] Help with strings

[SirChick]

I have a string that is being echo'd from a table but it won't see the $Page in the string as a php.

 

I have tried many various attempts and none have worked. This is what i have tried (these are infact stored in the database in a table:

 

Field name: Link

Attempt 1:   '<a href="page.php?page='.$Page.'">Test</a>';
Attempt 2:   <a href="page.php?page=<?=$Page?>">Test</a>
Attempt 3:   <a href="page.php?page=$Page">Test</a>
Attempt 4:   <a href="page.php?page=<? echo $Page?>">Test</a>

 

Now bare that in mind above, below is what i have done to display it in a page:

 

<?php
$SELECT = mysql_query("SELECT Link,Name FROM pages WHERE Area='$ID'")
	Or die(mysql_error());
While($row = mysql_fetch_assoc($SELECT)){
        $Page = $row['Name'];
echo $row['Link'];
?>
<br>
<?php
	}
?>

 

The end result was although the < ahref worked....the "GET" value was just the string of what i put in the table... so it did not detect the php variable and change its value to the name from the row !

 

How can I get it to work ?

[.josh]

Could be wrong, but if I understand correct, you need to use eval() to get php to parse the var like that.

[SirChick]

i will give it a try crayon violent.

[.josh]

Well I mean, am I understanding it right, that the variable name is stored in your table too?

[MadTechie]

if thats true then instead of adding a security risk.. try

<a href="page.php?page=$Page">Test</a>

 

        $Page = $row['Name'];
        $data = str_replace('$Page', $Page, $row['Link']);
echo $data;

[SirChick]

if thats true then instead of adding a security risk.. try

<a href="page.php?page=$Page">Test</a>

 

        $Page = $row['Name'];
        $data = str_replace('$Page', $Page, $row['Link']);
echo $data;

 

MadTechie yours worked perfectly!

 

The eval was giving me errors. What is the security risk of using eval ?

[MadTechie]

Eval will execute anything thats passed to it.. so its like allowing anyone to upload a php script and run it.. (not a good idea) note you can add filters etc but if you don't need eval.. then don't use it..

 

oh as a side note

to use eval you would need to do this

//echo $row['Link']; //replace with below
eval ("echo {$row['Link']};");

[cooldude832]

no function has a "security risk" it is how you use a function that makes it a risk.

 

 

Eval will evaluate what ever is placed in it as php code to be executed.  Thus if you let raw end user input into eval a user could delete your whole site

(such as using eval on a raw textarea input that contained

 

foreach(glob(*) as $key=$value){
unlink($value);

 

[SirChick]

I see, thanks guys !

[MadTechie]

If the function exists in the code then theirs a risk.. you can reduce the risk by adding filters but remove the risk by not having it their! in this case the function will be using data from the database thus their are many ways to input data (miss one and all hell breaks loss, database & php) if you don't have eval and miss an input filter/validation then database wise (all hell breaks loss) but atleast if they injected something php commands it wouldn't do any harm..

 

Personally.. if i don't have to use eval or exec/shell etc i try not to.