Intepolation within string in a variable?

[David Aldred]

Evening all!

Sorry if its a faq of some sort, but I haven't found an answer to this as
yet.

I'm trying to write a function which will go and get data out of a database
and lay it out. The awkward bit is that I want to be able to vary the
layout: I want to be able to pass a string to the function to define the
layout.

So in the simplest form of the situation (ignoring the database bit) I want
to be able to do something like

function myshow($x)
{ $Text = "wibble";
echo $x;
}

myshow("This is \$Text \n");
myshow("And so is this.... \$Text !!!")

and get the output

This is wibble
And so is this.... wibble !!!
I can't get it to work - is it possible, perhaps with some manipulation of
the syntax of the string?

--
David Aldred

[Janwillem Borleffs]

David Aldred wrote:

I can't get it to work - is it possible, perhaps with some
manipulation of the syntax of the string?

This is one of the rare situations where eval is useful:

function myshow($x) {
$Text = "wibble";
eval("print \"$x\";");
}
JW

[Jan Pieter Kunst]

David Aldred wrote:

So in the simplest form of the situation (ignoring the database bit) I want
to be able to do something like

function myshow($x)
{ $Text = "wibble";
echo $x;
}

myshow("This is \$Text \n");
myshow("And so is this.... \$Text !!!")

and get the output

This is wibble
And so is this.... wibble !!!
I can't get it to work - is it possible, perhaps with some manipulation of
the syntax of the string?

The eval() solution is cool. This one, though less elegant, also works:

function myshow($x)
{ $Text = "wibble";
echo str_replace("\$Text", $Text, $x);
}

JP

--
Sorry, <de*****@cauce.org> is a spam trap.
Real e-mail address unavailable. 5000+ spams per month.

[NC]

David Aldred wrote:

I'm trying to write a function which will go and get data out
of a database and lay it out. The awkward bit is that I want
to be able to vary the layout: I want to be able to pass a
string to the function to define the layout.

So in the simplest form of the situation (ignoring the database
bit) I want to be able to do something like

function myshow($x)
{ $Text = "wibble";
echo $x;
}

myshow("This is \$Text \n");
myshow("And so is this.... \$Text !!!")

and get the output

This is wibble
And so is this.... wibble !!!

You can use eval() as Janwillem suggested, or pass to the myshow()
function a string containing a placeholder:

function myshow($x) {
echo str_replace('###WIBBLE###', 'wibble', $x);
}
myshow("This is ###WIBBLE### \n");
myshow("And so is this.... ###WIBBLE### !!!")

Cheers,
NC

[John Bokma]

Jan Pieter Kunst wrote:

The eval() solution is cool. This one, though less elegant, also
works:

function myshow($x)
{ $Text = "wibble";
echo str_replace("\$Text", $Text, $x);
}

There are many, many situations the above is *more* elegant.

--
John MexIT: http://johnbokma.com/mexit/
personal page: http://johnbokma.com/
Experienced programmer available: http://castleamber.com/
Happy Customers: http://castleamber.com/testimonials.html

[Brion Vibber]

Janwillem Borleffs wrote:

This is one of the rare situations where eval is useful:

function myshow($x) {
$Text = "wibble";
eval("print \"$x\";");
}

Never *ever* use a function like that on client-supplied data that
hasn't been very carefully validated, or you may find with something
like this:

myshow('"; exec("arbitrary shell commands"); print "');

-- brion vibber (brion @ pobox.com)

[nr]

Brion Vibber wrote:

Janwillem Borleffs wrote:

This is one of the rare situations where eval is useful:

function myshow($x) {
$Text = "wibble";
eval("print \"$x\";");
}

Thanks for that - I think it meets the need here very nicely!
Never *ever* use a function like that on client-supplied data that
hasn't been very carefully validated,

Good point. In this case the layout string passed to the function will
always come from the script itself, and the actual data from the
(already cleaned up) database fields, so should be safe.

Again, thanks for all the help.

--
David Aldred

[Chung Leong]

"Jan Pieter Kunst" <de*****@cauce.org> wrote in message
news:42***********************@news.xs4all.nl...

David Aldred wrote:

So in the simplest form of the situation (ignoring the database bit) I want to be able to do something like

function myshow($x)
{ $Text = "wibble";
echo $x;
}

myshow("This is \$Text \n");
myshow("And so is this.... \$Text !!!")

and get the output

This is wibble
And so is this.... wibble !!!
I can't get it to work - is it possible, perhaps with some manipulation of the syntax of the string?

The eval() solution is cool. This one, though less elegant, also works:

function myshow($x)
{ $Text = "wibble";
echo str_replace("\$Text", $Text, $x);
}

The eval() solution is not cool at all. That's precisely what the santy worm
exploited.

strtr() is probably a better solution here, as it can make mutiple
replacement in one call.

[Jan Pieter Kunst]

Chung Leong wrote:

The eval() solution is not cool at all. That's precisely what the santy worm
exploited.

Well, as long as what is eval()'d is known beforehand to be safe, i.e.
no user-submitted data, it it really that bad? Surely that leaves no
room for exploits?

Or am I overlooking something?

JP

--
Sorry, <de*****@cauce.org> is a spam trap.
Real e-mail address unavailable. 5000+ spams per month.

[Brion Vibber]

Jan Pieter Kunst wrote:

Chung Leong wrote:

The eval() solution is not cool at all. That's precisely what the
santy worm exploited.

Well, as long as what is eval()'d is known beforehand to be safe, i.e.
no user-submitted data, it it really that bad? Surely that leaves no
room for exploits?

It's a matter of risk management. Knowing that human software developers
_do_ make mistakes, what's the likely result of an error in input
verification?

If you make a mistake with str_replace() or strtr(), you'll just get
incorrect output. Depending on the use of the output JavaScript or SQL
injection might be possible; other uses might not be exploitable to any
significant end.

If you make a mistake with eval() and the data is not formatted safely
after all, the possible results are very high-danger: arbitrary local
code execution as web server user, no matter what the replaced text is
to be used for.

-- brion vibber (brion @ pobox.com)