Excecute a variable as php script

How to parse the contents of $foo ..

[chriswragg]

Basically I want a page to display a text area and into there i will type a php script. This will then submit to another page which I want to parse the $_POST variable.

Before anyone mentions the security threat that this could pose, it will be htaccess protected, and will only be available for me to use for testing purposes only.

For Example:
In the text area I type
<?
echo "Hello World"
?>

And in my script:
<?
$foo = $_POST['php'];
//Then something to parse $foo so that Hello World is echoed
?>

Thanks in advance

Chris

[dmorison]

Have a look at:

[uk.php.net...]

[chriswragg]

I've written this code, however it does not seem to work. In the text box do I need to include <? or?>? Please can you suggest any corrections. Thanks.

<?
if(!isset($_POST['php'])){
?>
<form method="post" action="">
<textarea name="php" cols="100" rows="20" id="php"></textarea><input name="" type="submit">
</form>
<?
}else{
$code = $_POST['php'];
eval("\$php = \"\$code\"");
}
?>

[dmorison]

eval("\$php = \"\$code\"");

Have you tried it without the "$php ="?

If you're still having problems, the first thing to do is bypass the form side of things and just make sure that eval() is working as you would expect. Once that works, then try incorporating your form code but using the exact same PHP that you just tried directly.

[chriswragg]

I removed the $php = part of the eval() function, and then defined $code as a string:

$code = 'echo "Hello World";';
eval($code);

and this worked fine.

However when I changed the code back to:

$code = $_POST['php'];
eval($code);

and typed echo "Hello World"; into the text box and submitted it I got the following error:

Warning: Unexpected character in input: '\' (ASCII=92) state=1 in C:\Program Files\Apache Group\Apache2\www\testphp.php(23) : eval()'d code on line 1

Parse error: syntax error, unexpected $end in C:\Program Files\Apache Group\Apache2\www\testphp.php(23) : eval()'d code on line 1

[chriswragg]

Thanks for all of your previous help. I had to stripslashes() from the posted variable and then it worked.

Chris