Click to See Complete Forum and Search --> : Having troubles using eval().


HellgY
01-20-2006, 07:08 AM
OK, I use the following syntax to extract a standard message from the DB
and convert the variables in it to their values:

$query="SELECT * FROM messages WHERE shortcut='registration'";
$result=mysql_query($query, $link);
$row=mysql_fetch_array($result, MYSQL_ASSOC);
$activekey=rand_string();
eval("\$row['body']=\"$row['body']\";");

The content that stored in the 'body' column of the selected row is:

Hello!,$_POST['name'] .
Thanks for singing on to our site!,
Please follow the link bellow within 24 hours since this notification was issued,
otherwise it will void, and you will have to register all over again.
regards,
Total NBA Team team.

Active registration:
http://www.opendD4U.net/active.php?ID=$userid&code=$activekey

This variable will later be used as the E-mail validation message content!.
I receive the following error for the line in which the eval() function placed:

Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in /home/nitay/domains/opend4u.net/public_html/Oleg/Register.php on line 92

------
I also get the following error for the line masked with '//' in the code in the bottom of the page.
Error:

Parse error: syntax error, unexpected T_ELSE in /home/nitay/domains/opend4u.net/public_html/Oleg/login.php on line 68


This code meant to verify that the user is authorized to view the page, and it
included in all the pages of the site, using internal server path, after the defination of $clearance for every page.
Code:

<?php
if(isset($_COOKIE['name']) and isset($_COOKIE['password']))
{
$query="SELECT name, password, status FROM users WHERE name='".$_COOKIE['name']."' AND password='"
.$_COOKIE['password']."'";
$result=mysql_query($query, $link) or die(mysql_error()."--".$query);
if(@mysql_num_rows($result)==0)
{
print("you have illegal cookies<br><a target=\"_self\" href=\"login.php?do=disconnect\">Erase the cookies</a>");
die();
}

$row=mysql_fetch_array($result, MYSQL_ASSOC);
mysql_free_result($result);
if($clearance==0)
{
if($row['status']==3)
{
print("You are banned and cannot access any of this site's pages");
die();
}
}
else
{
if($row['clearance']<$clearance)
{
switch($clearance)
{
case '1':
print("You must activate your account before accessing this page");
break;
case '2':
print("This page is not available for your user group");
break;
case '3':
print("This page is not available for your user group");
break;
case '4':
print("This is not available for you user group");
break;
case '5';
print("Only the site owner can access this page");
$distenation=referred();
include('Redirect.php');
die();
}
}
}
}
else
{
if($clearance!=0)
{
print("you must login before you can access this page<br>click <a target\"_SELF\" href=".
$_SERVER['PHP_SELF']."?do=login>here</a>");
die();
}
}


?>

HellgY
01-20-2006, 01:57 PM
Bumpy

NogDog
01-20-2006, 03:43 PM
Try changing the content of that field to:

Hello!, {$_POST['name']}.
Thanks for singing on to our site!,
Please follow the link bellow within 24 hours since this notification was issued,
otherwise it will void, and you will have to register all over again.
regards,
Total NBA Team team.

Active registration:
http://www.opendD4U.net/active.php?ID=$userid&code=$activekey

HellgY
01-20-2006, 05:15 PM
Will try, tried every each separately but not two together, Any ideas about the second problem i mentioned?.

NogDog
01-20-2006, 05:50 PM
No idea, particularly since the error is reported on line 68 and you only provided us with about 60 lines of code. (Running those 60 lines locally gave me no such error, just a warning that $clearance is undefined.)

HellgY
01-20-2006, 06:05 PM
Nope, the line in which eval() placed returns the following error:

Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in /home/nitay/domains/opend4u.net/public_html/Oleg/Register.php on line 92

The other errors are under secondary priority.

NogDog
01-20-2006, 06:35 PM
After toying around with it a bit, I got this code to work:

<?php
// simulate text from database:
$row[body] = 'Hello!,{$_POST[\'name\']} .'.
'Thanks for singing on to our site!,'.
'Please follow the link bellow within 24 hours since this notification was issued,'.
'otherwise it will void, and you will have to register all over again.'.
'regards,'.
'Total NBA Team team.'.
''.
'Active registration:'.
'http://www.opendD4U.net/active.php?ID=$userid&code=$activekey';
// simulate $_POST data:
$_POST['name'] = "Test Name";
// Do the eval() and show the result:
eval('$row["body"] = "'.$row['body'].'";');
echo "<p>{$row['body']}</p>\n";
?>

bokeh
01-20-2006, 07:10 PM
'Thanks for singing on to our site!,'Should be signing but worth a laugh. Here's line 68 from some code that was emailed to me:}
mysql_free_result($result);
else // line 68 The error is caused because there is a call to a function between the curly brace and the else.

HellgY
01-21-2006, 11:43 AM
Well, I'm not getting the error that Bokeh referring to anymore,
Tho i do get an error from the line in which eval() placed.
Thanks for you attempts to help me.

NogDog
01-21-2006, 05:14 PM
An alternative would be to put a place-holder in the DB text, something like:

Hello, [name].
Thanks for signing on to our site.
.......

Then use strreplace():

$row['body'] = str_replace('[name]', $_POST['name'], $row['body']);

bokeh
01-21-2006, 05:34 PM
Line 92 error: You think the database contains this:$_POST['name'] but really it contains this$_POST[''name'']

HellgY
01-22-2006, 06:50 AM
WoW, I can't imagine how did you determine that!, very precise, thanks.
I'm looking at my code now, that might sound very dumb, but i don't seem to
figure out how does this quote mark got there...
I'll appreciate a hint :P.
How can i solve this, maybe?^^.
NogDog, str_replace() was my first choice... when it failed me i turned to eval...

bokeh
01-22-2006, 07:51 AM
Which file wrote that line to the DB?

HellgY
01-22-2006, 08:02 AM
Hmm, EditMessages.php edits the 'title' and 'body' values in a selected row.

bokeh
01-22-2006, 08:15 AM
Ok... So that was an error with the data that was entered into the <textarea>. There is no php error in the code that caused that. The code is gathered here:<textarea cols=\"50\" rows=\"20\" name=\"body\" dir=\"rtl\" wrap=\"physical\" maxlength=\"3500\">".$row['body']."</textarea>and entered into the DB here:$query="UPDATE messages SET title='".$_POST['title']."', body='".$_POST['body']."' WHERE shortcut='".$_POST['shortcut']."'"; Nothing in the php code modifies $_POST['body'] so all I can guess is the person filling in the <textarea> got it wrong.

As a sidenote: If the client has access to this file expect your application to soon become corrupted again.

HellgY
01-22-2006, 08:56 AM
Hmm, tried to replace the text in the DB with an empty space, but no luck.
Also, I cant see anything wrong with my query:\
Thanks!.