-2

So I'am trying to add Php code to the database it works when I insert it in the database. But when I go to the browser the Php code I added was commented image

code:

$insert = 
      '</div>
      <br><br><br>
      <div class="posts-container">
        <img src="'.$img.'" class="profpic"/>
        <div class="editB-cont">
          <img src="img/editB.png" class="editB"/>
        </div>
          <h1>'.$sender.'</h1>
        <hr class="solid">
        <p class="post-text-container">'.$post.'</p>
        <br><br>
        <img src="'."attatch/".$newfilename.'" class="attach"/>
        <br><br>
        <form action="post-comment" method="post">
          <input type="hidden" name="parent-id" value="<?= echo $postId; ?>">
          <input type="text" name="comment-text" placeholder="Comment...">
          <input type="submit" value="Post" name="submit">
        </form>
        <br>
        <div class="coments">
          <?= include("get-comment.php"); ?>
        </div><br>
    </div><br><br>
    ';

    
  
      $sql = "INSERT INTO posts (sender, post, sender_id, image_attach, sender_img) VALUES ('$sender', '$insert', $id, 'attatch/$newfilename', '$img')";
      if (mysqli_query($conn, $sql)) {
        header("Location: view-profile?id=$id");
      } else {
        echo "Error: " . $sql . "<br>" . mysqli_error($conn);
      }
    }

Is there any way to fix this?

Dharman
  • 30,962
  • 25
  • 85
  • 135
user14686723
  • 3
  • 1
  • 2
    Please note that the way you're building your query is unsafe. You're open to [SQL injection](https://stackoverflow.com/questions/332365/how-does-the-sql-injection-from-the-bobby-tables-xkcd-comic-work). You should use [prepared statements](https://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php) instead. – El_Vanja Nov 22 '20 at 15:00
  • How and where are you using this code? – El_Vanja Nov 22 '20 at 15:01
  • For a profile type of site – user14686723 Nov 22 '20 at 15:02
  • That's not what I meant. Where in your code do you make use of the stored values? – El_Vanja Nov 22 '20 at 15:03
  • Is this a safe method https://www.w3schools.com/php/php_mysql_insert.asp the last one – user14686723 Nov 22 '20 at 15:06
  • No, don't listen to w3schools when it comes to PHP or SQL. They have terrible advice. – Dharman Nov 22 '20 at 15:10
  • Your problem here is obvious. You think that the HTML is PHP, but it's not. You can't include file from within a string. You need to split it into two strings and put include in the middle. – Dharman Nov 22 '20 at 15:11
  • So about this sql thing so I need to use the object oriented type of style? – user14686723 Nov 22 '20 at 15:19
  • OO style is always a good idea, but that is not the point. You must use data parameterization which is offered with prepared statements. If you are only starting your PHP journey then it will be easier for you to learn PDO instead of mysqli. – Dharman Nov 22 '20 at 15:22
  • I need help in closing a PDO statement ` $link = new PDO("mysql:host=$host;dbname=$dbName", $user, $pass); $statement = $link->prepare('INSERT INTO posts (sender, post, sender_id, image_attach, sender_img) VALUES (:fname, :sname, :age)'); $statement->execute([ 'sender' => $sender, 'post' => $insert, 'sender_id' => $id, 'image_attach' => 'attatch/$newfilename', 'sender_img' => $img, ]); $link->connection = null; }else{ header("Location: index"); exit(); } ?>` it says Parse error – user14686723 Nov 22 '20 at 16:06

1 Answers1

0

Like Dharman said, $insert should be divided, so assign your include to a variable and then create $insert like so: 'first part until div class=comments' . $includeVariable . 'second part';

Regarding the sql injection, just google php prepared statements, or check this w3schools article https://www.w3schools.com/php/php_mysql_prepared_statements.asp

EDIT

in get_comment.php

$comment = 'just a test';
return $comment;

then

$includeVariable = include('get_comment.php');
$insert = 'first part' . $includeVariable . 'second part';

EDIT 2

You could try using eval() to display $insert or that commented part of it, HOWEVER as php manual states:

Caution The eval() language construct is very dangerous because it allows execution of arbitrary PHP code. Its use thus is discouraged. If you have carefully verified that there is no other option than to use this construct, pay special attention not to pass any user provided data into it without properly validating it beforehand.

This leads to another issue, probably the most important one: storing blocks of code like that in a database is a sign of a seriously bad design, you should think how to avoid it and rewrite you code rather than try to make it work

EDIT 3

Your PDO is wrong, in $link->prepare() number of database columns you insert into and number of inserted values must be the same, for example, I insert two values into two columns:

INSERT INTO user(name, age) VALUES (:name, :age)

which is same as

INSERT INTO user(name, age) VALUES (?, ?)

then you bind parameters

$statement->bind_param('si', $name, $age)

where 'si' are parameters types: (s)tring and (i)nteger, check https://www.php.net/manual/en/mysqli-stmt.bind-param.php for details

then assing values to you variables

$name = 'John';
$age = 44;

finally execute

$statement->execute();
user2463644
  • 211
  • 1
  • 8