PHP/MySQl/Apache

Question

Dear All,
if I embed this within the body of my php page, <?php
getFileSize('cover.pdf') ?>, all is well and I get the
desired result.
However, if I embed the same text, <?php
getFileSize('cover.pdf') ?>, into
my MySQL database, I get absolutely nothing at all.
Have tried adding htmlentities, urlencode and other such
fabulous things,
but all to no avail.
Basically, my knowledge isn't good enough, but somehow MySQL
seems to be
disabling the function. I guess I need to 'escape' the code
in some manner?
Any clues?
Craig Sherwood

Answer 1

David and Joris,
your posts make fascinating reading - many thanks.
I guess the one thing to explain is why!
I have a database driven site. My users enter information
into the database
via an admin section.
In their text they need to be able to enter links to
PDF/doc/jpg files.
These links could be anywhere in the text, thus it can't be
limited to a
designated field.
However, when the site visitors look at a page, I wanted to
be able to show
them the file size, so that they don't download unnecessarily
large files by
accident.
Hence the need for my users to be able to enter the file name
in a bit of
code and have the relevant page show file size in amongst the
text.
Craig
"David Powers" <[email protected]> wrote in message
news:[email protected]...
> Craig wrote:
>> So then the obvious question surely is how do you
execute a piece of code
>> if the 'call' to the function is in a database
field?
>
> The answer is that you don't do it. There is a PHP
function eval(), which
> evaluates a string as code. To achieve the type of
result that you want,
> however, it involves storing your string in the database
as PHP code. Try
> this simple example using your human() function:
>
> $filesize = 12345;
> $string = '$size = human($filesize); echo "This is the
size: $size";';
> eval($string);
>
> This displays "This is the size: 12.1k".
>
> The question remains why on earth you would want to
store PHP code in a
> database simply for the purpose of running it in a PHP
script? It makes
> far more sense to embed the code in your main script.
More importantly,
> eval() is considered to be a serious security risk. A
common saying among
> PHP developers is "Eval() is evil".
>
>> After-all, html code can be put in a field, but
rendered as proper html
>> (such as links for example) without the html code
(<a href etc) being
>> displayed.
>
> HTML is just plain text, which is interpreted by the
browser by referring
> to the text/html MIME type in the header. PHP needs to
be executed on the
> server before the output is sent to the browser. The
opening and closing
> PHP tags in a text field retrieved from a database are
treated as text in
> the same way as a PHP variable is treated as text when
included in single
> quotes. The only way to execute code stored in a
database is to use
> eval(), which has serious drawbacks.
>
>> FYI: The 'human' function displays either 'kb' or
'm' depending on the
>> file size and executes perfectly.
>
> Yes, after studying it more carefully, I have finally
worked out how it
> functions. It uses a for loop in a rather unconventional
way, which is
> what confused me. It also converts bytes to Gigabytes.
>
> --
> David Powers, Adobe Community Expert
> Author, "The Essential Guide to Dreamweaver CS3"
(friends of ED)
> Author, "PHP Solutions" (friends of ED)
>
http://foundationphp.com/