Opinion on best way to do this.

[cooldude832]

I'm rewriting my CMS a bit and now I want to be able to include php support in my content sections of the page

 

The content section will be stored as a BLOB in a mysql table and I already have the retrival working

 

My question is when I retrieve the content it comes out of mysql as a big long string, when portions of it need to be evalulated using eval() to run the php that is in them.

 

I'm using a delimeter rihgt now of

to define the begining and end of a php block.  What do you all think is the best method of separating the 1 string of content into the sections of it like

 

HTML DATA

PHP BLOCK

HTML DATA

PHP BLOCK

 

sorta like that, but in an unpredictable number of times.

 

<?php
$content = "<h3>Hows it going?</h3>[code=php:0]echo "<br />Hello World!<br />";

";<h2>The world responds, Welcome!</h2>";

?>

[/code]

 

That is what the content looks like

[laffin]

if ya dun have any nesting than preg_match prolly the easiest way to go, if ya got some nesting going on, than ya will have to build a tokenizer/parser to go balance out the begin delimeter and the ending delimeter.

[Daniel0]

Just use the PHP opening and closing tags:

 

Hello, the time is now <?php echo date('r') ?>!

<?php
// page content is stored in $content...

ob_start();
eval('?>' . $content);
$parsed_content = ob_get_contents();
ob_end_clean();
?>

 

Syntax highlighting broke, but it should work.

[cooldude832]

so it should output somethign but i'm getting a blank

[cooldude832]

I used ob_flush and it works (saves declaring a variable)

 

<?php
	ob_start();
	eval('?>' . $content);
	ob_end_flush();

[Daniel0]

Well, if you don't wish to store it in a variable then there is no use of the output buffering.

[cooldude832]

but if I buffer it and say that block is like 5000 lines then I don't have that ugly halfling load happening

[cooldude832]

Now to offer Full text search on that databased area I want to have that php be processed, should I do something where it loads each page and then caches the content every X hours or on each update it caches the page data for full text search?  Something like that?

[resago]

not sure if this fits in your scheme, but have you considered, writing the blob to a temporary file according to session and then include() ing it?

 

[cooldude832]

I'd thing that bog down the work if I have to write a ton of temp files and delete on load outs.

 

The eval combo is working.

 

However if I write the content to a temp file and then store that as text (each time its updated + a 1 time weekly cron caching)  I think I get a good full text search pool. 

 

You think?

[roopurt18]

You need to be really careful allowing PHP to be entered.  If a user of your CMS has their account compromised then an attacker will be able to do all sorts of stuff on the server.

[cooldude832]

I already have backup systems in place and a tiered admin based system.  So I can prevent most people other than me from accessing certain page or certain parts such as php.

 

My main goal of it was to allow my contributing users to upload pages with BB style code so that when they want to upload their articles I don't have to do it myself. 

 

I also then took it a step further and said well i'm lazy and don't want to have to FTP to mod a page so i'll give my self access.  And my event secretary access and so forth.

 

Ideally I want to eventually roll it out as a complete CMS package but thats a way of way.

 

 

I questioned the allowing php as the first thing I had.  The backups are emailed to me, and the system can restore on a single click off a db dump.

[laffin]

Why wud u need the full power of php?

Just a question, as i did write a limited gd language for users to be able to generate their own dynamic image signatures.

So ya may want to think of going the same way.

trying to limit a powerful language, may be more cumbersome than thought initially.

when developing a limiting language may be simpler

 

[cooldude832]

Because I need full power php

 

I have tiered level admin and there will be a sub php admin. 

[laffin]

than consider something where the code is stored in the db.

 

create a random filename

 

store the content into the temp file

start ob_start buffering

include the file

grab the contents

stop buffering

delete the temp file

 

 

now ya have the output contents in a string,

which ya can do whatever ya want

to prevent the user created routine from doing things inadvertently to global vars

ya may want to save/restore the global vars and put the above into a function.

 

 

 

[cooldude832]

I've thought this through enough to realize that limiting the power of your php is just not good, joomla and all those CMS that let you baby in some php aren't what i want.  I know how php works, and the people who will have power to adjust the php in it will also have knowledge of it.  I have a dual back up system on it.

1) It backs up daily/weekly based on settings

2) It backs up 4 saves back of each file so you can roll back if you do somethign really bad.  Now mind you deleting a file will total nuke all roll back, but that is what back up 1 does

 

back up 1 is a compelte zip + mysql dump of the server that you can reload from a single file.  It will dezip that pile rebuild mysql and restory the whole server to the zip's content.

[laffin]

Okay, than definely try using temp files

 

function docode($code)
{
  file_put_contents($tfn="tmp/". time() . ".tmp",$code)
  ob_start();
  include($tfn);
  $contents=ob_get_contents();
  ob_end_clean();
  unlink($tfn);
  return($contents);
}

 

should do the trick

 

[cooldude832]

why ob buffering with php tags works perfectly fine.  The temp files requires me to write something I don't want to