eval()

[drisate]

Hey guys i am currently playing arround with a vbulletin installation. I wanted to add some PHP code into a template so i did this

 

$testing = '<table class="tborder" width="100%" align="center" border="0" cellpadding="6" cellspacing="1">
<tr>
	<td class="tcat" width="50%">Informations challenge</td>
	<td class="tcat" width="50%">Informations participation</td>
</tr>
<tr valign="top">
	<td class="panelsurround" align="center">
	<div class="panel">
		<div align="left">xxx</div>
	</div>
	</td>
	<td class="panelsurround" align="center">
	<div class="panel">
		<div align="left">
			<div class="fieldset">
				xxx</div>
		</div>
	</div>
	</td>
</tr>
</table>';
    
$tt = str_replace('[allo]', $testing, fetch_template($templatename));
eval('print_output("'.$tt.'");');

 

and now i get a

 

Parse error: syntax error, unexpected T_STRING in public_html/forum/member.php(831) : eval()'d code on line 252

 

The original string looked like this

 

eval('print_output("' . fetch_template($templatename) . '");');

 

I juste wanted to replace [allo] with some new code ...

 

strange thing is if i remove the $testing var from the STR replace the page loads with out the error

 

$tt = str_replace('[allo]', '', fetch_template($templatename));
eval('print_output("'.$tt.'");');

 

So for some reason it does not like complex HTML?

 

I tryed this and it worked

 

$tt = str_replace('[allo]', '<b>Hello</b>', fetch_template($templatename));
eval('print_output("'.$tt.'");');

 

So why the hell does my $testing var return that error lol

[teynon]

You'll have to escape all those quotes in that string.

[dcro2]

Orr... you know, use single quotes, since that's what you used to define the string:

eval("print_output('$tt');");