Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #3551 > unrolled thread

execute php in template

Back to article view | Back to comp.lang.php

Contents

  execute php in template cerr <ron.eggler@gmail.com> - 2011-10-23 12:47 -0700
    Re: execute php in template Jerry Stuckle <jstucklex@attglobal.net> - 2011-10-23 16:29 -0400
    Re: execute php in template The Natural Philosopher <tnp@invalid.invalid> - 2011-10-23 22:03 +0100
      Re: execute php in template cerr <ron.eggler@gmail.com> - 2011-10-23 15:43 -0700
        Re: execute php in template Gregor Kofler <usenet@gregorkofler.com> - 2011-10-24 01:20 +0200
        Re: execute php in template Jerry Stuckle <jstucklex@attglobal.net> - 2011-10-23 19:38 -0400
          Re: execute php in template Hans Olo <doctor@vaderlishious.com> - 2011-10-23 20:37 -0500
            Re: execute php in template Jerry Stuckle <jstucklex@attglobal.net> - 2011-10-23 22:30 -0400
              Re: execute php in template Hans Olo <doctor@vaderlishious.com> - 2011-10-24 07:39 -0500
                Re: execute php in template Jerry Stuckle <jstucklex@attglobal.net> - 2011-10-24 09:16 -0400
    Re: execute php in template Goran <goran@nospam.com> - 2011-10-24 09:02 +0200

#3551 — execute php in template

hi There,

I have a page that i assemble with a graphics template and a content
file in my index.php. Kinda like:
<?
$template = file_get_contents($tmpl_path);
$content = file_get_contents($cont_path);
and in template, there's a marker where to insert the content:
$page = str_replace("[CONTENT]",$content,$template);
echo $page.

This works well so far, but if I wanna use php in my template, it
doesn't get executed by file_get_contents(). How can I load this file
and execute php within it? Also, I would like to reuse ($_GET)
variables i have in index.php. Do I need to forward them to my
template by a regular get url or will i just be able to reuse the
variables straight?
Thanks for help in this matter!

Ron

[toc] | [next] | [standalone]

#3552

On 10/23/2011 3:47 PM, cerr wrote:
> hi There,
>
> I have a page that i assemble with a graphics template and a content
> file in my index.php. Kinda like:
> <?
> $template = file_get_contents($tmpl_path);
> $content = file_get_contents($cont_path);
> and in template, there's a marker where to insert the content:
> $page = str_replace("[CONTENT]",$content,$template);
> echo $page.
>
> This works well so far, but if I wanna use php in my template, it
> doesn't get executed by file_get_contents(). How can I load this file
> and execute php within it? Also, I would like to reuse ($_GET)
> variables i have in index.php. Do I need to forward them to my
> template by a regular get url or will i just be able to reuse the
> variables straight?
> Thanks for help in this matter!
>
> Ron

You can use the exec() command to do it, but such operations are VERY 
DANGEROUS and not recommended. For instance, what if someone snuck into 
your code something like:

system('rm -r /');

That will (on unix) erase everything available to the process on your 
hard drive.  You use exec() at your own risk and don't be surprised when 
your system is hacked.

Each request to a page is a new execution unit, and the only things 
available to the execution are what you send it.  There are a number of 
ways you can do it, i.e. $_GET parameters, sessions, cookies, hidden 
fields in a submitted form... but nothing from previous script 
executions will be available without it.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#3553

cerr wrote:
> hi There,
> 
> I have a page that i assemble with a graphics template and a content
> file in my index.php. Kinda like:
> <?
> $template = file_get_contents($tmpl_path);
> $content = file_get_contents($cont_path);
> and in template, there's a marker where to insert the content:
> $page = str_replace("[CONTENT]",$content,$template);
> echo $page.
> 
> This works well so far, but if I wanna use php in my template, it
> doesn't get executed by file_get_contents(). How can I load this file
> and execute php within it? Also, I would like to reuse ($_GET)
> variables i have in index.php. Do I need to forward them to my
> template by a regular get url or will i just be able to reuse the
> variables straight?
> Thanks for help in this matter!
> 

try
include("/path/to/my_template");

> Ron

[toc] | [prev] | [next] | [standalone]

#3555

On Oct 23, 2:03 pm, The Natural Philosopher <t...@invalid.invalid>
wrote:
> cerr wrote:
> > hi There,
>
> > I have a page that i assemble with a graphics template and a content
> > file in my index.php. Kinda like:
> > <?
> > $template = file_get_contents($tmpl_path);
> > $content = file_get_contents($cont_path);
> > and in template, there's a marker where to insert the content:
> > $page = str_replace("[CONTENT]",$content,$template);
> > echo $page.
>
> > This works well so far, but if I wanna use php in my template, it
> > doesn't get executed by file_get_contents(). How can I load this file
> > and execute php within it? Also, I would like to reuse ($_GET)
> > variables i have in index.php. Do I need to forward them to my
> > template by a regular get url or will i just be able to reuse the
> > variables straight?
> > Thanks for help in this matter!
>
> try
> include("/path/to/my_template");
>

Thanks to both for the replies, I have not tried exec or passthru but
include e.g. won't return me anything, it'll just execute the template
right there instead of returning me a string that i'll be able to
modify (to insert the content)...

> what if someone snuck into
> your code something like:
> system('rm -r /');

How would someone be able to do that? From the "outside" there's no
access to do this, right?

Thanks,
Ron

[toc] | [prev] | [next] | [standalone]

#3556

Am 2011-10-24 00:43, cerr meinte:
> On Oct 23, 2:03 pm, The Natural Philosopher <t...@invalid.invalid>
> wrote:
>> cerr wrote:
>>> hi There,
>>
>>> I have a page that i assemble with a graphics template and a content
>>> file in my index.php. Kinda like:
>>> <?
>>> $template = file_get_contents($tmpl_path);
>>> $content = file_get_contents($cont_path);
>>> and in template, there's a marker where to insert the content:
>>> $page = str_replace("[CONTENT]",$content,$template);
>>> echo $page.
>>
>>> This works well so far, but if I wanna use php in my template, it
>>> doesn't get executed by file_get_contents(). How can I load this file
>>> and execute php within it? Also, I would like to reuse ($_GET)
>>> variables i have in index.php. Do I need to forward them to my
>>> template by a regular get url or will i just be able to reuse the
>>> variables straight?
>>> Thanks for help in this matter!
>>
>> try
>> include("/path/to/my_template");
>>
> 
> Thanks to both for the replies, I have not tried exec or passthru but
> include e.g. won't return me anything, it'll just execute the template
> right there instead of returning me a string that i'll be able to
> modify (to insert the content)...

Buffer the content (ob_start() and accompanying functions) and work with
the buffer content, flush buffer once you are done.

Gregor


-- 
http://vxweb.net

[toc] | [prev] | [next] | [standalone]

#3558

On 10/23/2011 6:43 PM, cerr wrote:
> On Oct 23, 2:03 pm, The Natural Philosopher<t...@invalid.invalid>
> wrote:
>> cerr wrote:
>>> hi There,
>>
>>> I have a page that i assemble with a graphics template and a content
>>> file in my index.php. Kinda like:
>>> <?
>>> $template = file_get_contents($tmpl_path);
>>> $content = file_get_contents($cont_path);
>>> and in template, there's a marker where to insert the content:
>>> $page = str_replace("[CONTENT]",$content,$template);
>>> echo $page.
>>
>>> This works well so far, but if I wanna use php in my template, it
>>> doesn't get executed by file_get_contents(). How can I load this file
>>> and execute php within it? Also, I would like to reuse ($_GET)
>>> variables i have in index.php. Do I need to forward them to my
>>> template by a regular get url or will i just be able to reuse the
>>> variables straight?
>>> Thanks for help in this matter!
>>
>> try
>> include("/path/to/my_template");
>>
>
> Thanks to both for the replies, I have not tried exec or passthru but
> include e.g. won't return me anything, it'll just execute the template
> right there instead of returning me a string that i'll be able to
> modify (to insert the content)...
>

You can buffer the content.  See ob_start(), ob_end_clean(), etc.

>> what if someone snuck into
>> your code something like:
>> system('rm -r /');
>
> How would someone be able to do that? From the "outside" there's no
> access to do this, right?
>
> Thanks,
> Ron

Are you sure?  Sony thought so...

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#3559

On 10/23/2011 6:38 PM, Jerry Stuckle cried from the depths of the abyss:
>
>>> what if someone snuck into
>>> your code something like:
>>> system('rm -r /');
>>
>> How would someone be able to do that? From the "outside" there's no
>> access to do this, right?
>
> Are you sure? Sony thought so...
>

Keep in mind that the rm request can only delete files that have the 
same permissions as the httpd user.  This is why apache recommends 
creating a bs account (httpd, acache, joeblow, etc.) to use to run the 
httpd server.  Almost all stock httpd configs use a bogus user (either 
configged by a package, or a requirement if compililng from source), and 
this wouldn't delete too much except www related files & perhaps some 
config files.

/ will only get deleted if the httpd is being run as root

[toc] | [prev] | [next] | [standalone]

#3560

On 10/23/2011 9:37 PM, Hans Olo wrote:
> On 10/23/2011 6:38 PM, Jerry Stuckle cried from the depths of the abyss:
>>
>>>> what if someone snuck into
>>>> your code something like:
>>>> system('rm -r /');
>>>
>>> How would someone be able to do that? From the "outside" there's no
>>> access to do this, right?
>>
>> Are you sure? Sony thought so...
>>
>
> Keep in mind that the rm request can only delete files that have the
> same permissions as the httpd user. This is why apache recommends
> creating a bs account (httpd, acache, joeblow, etc.) to use to run the
> httpd server. Almost all stock httpd configs use a bogus user (either
> configged by a package, or a requirement if compililng from source), and
> this wouldn't delete too much except www related files & perhaps some
> config files.
>
> / will only get deleted if the httpd is being run as root

Please read what I said in my first post.  And never count on the 
process being a bogus user with limited rights.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#3567

On 10/23/2011 9:30 PM, Jerry Stuckle cried from the depths of the abyss:

>> / will only get deleted if the httpd is being run as root
>
> Please read what I said in my first post. And never count on the process
> being a bogus user with limited rights.
>

I wasn't correcting you.  Just adding on to what you said.  Your warning 
could put the fear of root into newbies.  I just wanted to clarify is all.

[toc] | [prev] | [next] | [standalone]

#3568

On 10/24/2011 8:39 AM, Hans Olo wrote:
> On 10/23/2011 9:30 PM, Jerry Stuckle cried from the depths of the abyss:
>
>>> / will only get deleted if the httpd is being run as root
>>
>> Please read what I said in my first post. And never count on the process
>> being a bogus user with limited rights.
>>
>
> I wasn't correcting you. Just adding on to what you said. Your warning
> could put the fear of root into newbies. I just wanted to clarify is all.

Which is why I said "That will (on unix) erase everything available to 
the process on your hard drive.".

And NEVER count on the process being a bogus user with limited rights. 
Such assumptions are always dangerous.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#3562

On 23.10.2011 21:47, cerr wrote:
> hi There,
> 
> I have a page that i assemble with a graphics template and a content
> file in my index.php. Kinda like:
> <?
> $template = file_get_contents($tmpl_path);
> $content = file_get_contents($cont_path);
> and in template, there's a marker where to insert the content:
> $page = str_replace("[CONTENT]",$content,$template);
> echo $page.
> 
> This works well so far, but if I wanna use php in my template, it
> doesn't get executed by file_get_contents(). How can I load this file
> and execute php within it? Also, I would like to reuse ($_GET)
> variables i have in index.php. Do I need to forward them to my
> template by a regular get url or will i just be able to reuse the
> variables straight?
> Thanks for help in this matter!
> 
> Ron

Use output buffering functions to grab content before it is outputed.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.php

csiph-web