How Can I get PHP script to work in a MySQL row?! (Please help ASAP!)

[AlexthePirate]

Hi, I've almost set myself up a fully working CMS type thing, all that I'm lacking is a submission form, which I've made. for the pages, I'm using url variables, which are all attached to a column in my table, but for the submission form, I'm hoping to be able to use SQL, see, just say I went to www.site.com?act=page

in a file called vars.php, i have made it so that when you type in www.site.com?act=page, it finds the 'act' column in my table, and then echoes what's in the field under the same row as that act:

--------------------------------------------------------------------------------------------------+
content | title | act |
--------------------------------------------------------------------------------------------------+
Hello all! this is our homepage. Enjoy | Home | home |
--------------------------------------------------------------------------------------------------+

so that's my table, the page detects the $act url variable, and if it matches anything in the act column, it echoes what's in the content column of that row.

So a page of index.php?act=home would say:
Hello all! this is our homepage. Enjoy


Now onto my problem, for my page to make new pages, index.php?act=newpage, I want to have my form, including the php it needs to work in the content field, this is my code:

[PHP]<?php

$do = $_GET['do'];

if ( $do = submit ){
$title = $_POST['title'];
$content = $_POST['content'];
$act = $_POST['act'];

mysql_query("INSERT INTO pagecontent
(title, content, act) VALUES('$title', '$content', '$act' ) ")
or die(mysql_error());
echo 'Your page was successfully, if you&rsquo;d like to have your page put onto the menu, ask an Admin to put it up for you. (Please don&rsquo;t try to do it yourself!);
}

else {
echo '
<form method="post" action="index.php?act=newpage&do=submit">
<table cellspacing="0">
<tr>
<td>Page Title </td>
<td><input name="title" type="text" id="title" /></td>
</tr>
<tr>
<td>Page Content </td>
<td><textarea name="content" cols="50" rows="10" id="content"></textarea></td>
</tr>
<tr>
<td>Page URL </td>
<td>http://www.habbohero.com/?act=
<input name="act" type="text" id="act" size="5" /></td>
</tr>
<tr>
<td colspan="2"><input type="submit" name="Submit" value=" Create the Page! " /></td>
</tr>
</table></form>';} ?>[/PHP]

Is there any way I could get the php to work when i visit the form?

[AlexthePirate]

Bump?
Come on, someone help me out?

[coolsti]

I don't know, would this even have a chance of working?

I stopped looking at your code when I noticed that you are mixing both $_POST and $_GET variables. Usually you use only one, not both. $_POST is better in my opinion, as you do not have lots of things tacked on to your URL (which can then easilly be manipulated).

In your case, you are sending do=submit to be read in the $_GET array, but accessed when someone clicks submit on a form. Why not have this action is equal to submit sent as a $_POST variable instead, to be consistent?

[AlexthePirate]

I don't know, would this even have a chance of working?

I stopped looking at your code when I noticed that you are mixing both $_POST and $_GET variables. Usually you use only one, not both. $_POST is better in my opinion, as you do not have lots of things tacked on to your URL (which can then easilly be manipulated).

In your case, you are sending do=submit to be read in the $_GET array, but accessed when someone clicks submit on a form. Why not have this action is equal to submit sent as a $_POST variable instead, to be consistent?

All I'm using $_GET to do is get the URL variables, $_GET gets the $do variable from the url, if $do = submit, it submits the form results to the db, otherwise it displays the form (which is why i have the form's action as: index.php?act=newpage&do=submit ... the act is the page itself, my code (in vars.php) matches the url variable act with one from the db, so I want to be able to get the PHP code in my first post into a field of the table, and have it work if I go to index.php?act=newpage



Is it even possible to have PHP code inside a table field and have it run on a page as if it was on the page itself? If so, how?

[coolsti]

There are several good books out and also web links that give good intro explanations to PHP and how it works together with a web server to produce HTML code in a client-server environment. Perhaps a look there first?

[AlexthePirate]

There are several good books out and also web links that give good intro explanations to PHP and how it works together with a web server to produce HTML code in a client-server environment. Perhaps a look there first?

I'm perfectly fine with PHP and HTML, all I really need to know is how to have php/html in a table field, and have it execute on a page as if it was on the page itself

[coolsti]

I'm perfectly fine with PHP and HTML, all I really need to know is how to have php/html in a table field, and have it execute on a page as if it was on the page itself

Sorry, then, perhaps I am completely lost in what you are asking for. Maybe it is a language misunderstanding. What do you mean by "in a table field"? Do you mean in a database table? Or in an HTML table, like <table><tr><td>... etc.?

And I think you ought to explain what you mean by "and have it execute on a page as if it was on the page itself". This is confusing. Because, as you know since you are perfectly fine with PHP and HTML, PHP does not execute on the client PC, but on the server that creates the HTML and sends it to the client's page. So I am not sure what you are meaning here.

[AlexthePirate]

Sorry, then, perhaps I am completely lost in what you are asking for. Maybe it is a language misunderstanding. What do you mean by "in a table field"? Do you mean in a database table? Or in an HTML table, like <table><tr><td>... etc.?

And I think you ought to explain what you mean by "and have it execute on a page as if it was on the page itself". This is confusing. Because, as you know since you are perfectly fine with PHP and HTML, PHP does not execute on the client PC, but on the server that creates the HTML and sends it to the client's page. So I am not sure what you are meaning here.

what I mean is, have it in a MySQL table, then when I get it from the table (I'm fine with knowing how to do that too), put it in an array with mysql_fetch_array(); and then echo the part of the array I want (in this case, 'content' since that's the name of the MySQL Column i have the code up top in)
and then when I echo/print it, i was hoping it would be executed the same way it would have been if I just had an empty page with the code, not using MySQL

[coolsti]

Ah ok I think I understand now. Let me try. You wish to have the PHP code that is stored in the database as text be executed when the user "activates" it, in this case when they wish to create a new page.

The PHP code that is stored in the database is just text. It can be retrieved by, for example, a PHP script, but in order for it to be executed on the server in order to perform its tasks, it needs to be executed. So your code that is saved in the database has to be written in such a way that it can be fed into a PHP snippet that executes the strings stored in the database as PHP code. This is possible, but may be unsafe (you would be evaluating code that you do not have absolute control of, say if the database was hacked) so you need to do some checks to see that the code is correct.

To do this, see the eval() function in PHP. You would have to write the script that gets stored in the database in such a way that it all can become evalutated with the eval() function, including any HTML that is to be printed directly to the user.

You may want instead to write PHP functions as normal scripts, not in the database, which do the task you wish to have done, and just find some way of calling this when needed.