如何执行存储在 MySQL 数据库中的 PHP？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/41406/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How do I execute PHP that is stored in a MySQL database?
提问by different
I'm trying to write a page that calls PHP that's stored in a MySQL database. The page that is stored in the MySQL database contains PHP (and HTML) code which I want to run on page load.
我正在尝试编写一个调用存储在 MySQL 数据库中的 PHP 的页面。存储在 MySQL 数据库中的页面包含我想在页面加载时运行的 PHP（和 HTML）代码。
How could I go about doing this?
我怎么能去做这件事？
采纳答案by Erik van Brakel
You can use the evalcommand for this. I would recommend against this though, because there's a lot of pitfalls using this approach.Debugging is hard(er), it implies some security risks (bad content in the DB gets executed, uh oh).
您可以为此使用eval命令。不过我建议不要这样做，因为使用这种方法有很多陷阱。调试很难（呃），它意味着一些安全风险（数据库中的坏内容被执行，呃哦）。
See When is eval evil in php?for instance. Google for Eval is Evil, and you'll find a lot of examples why you should find another solution.
请参阅php 中的 eval 何时是邪恶的？例如。Google for Eval is Evil，你会找到很多例子，说明为什么你应该找到另一个解决方案。
Addition: Another good article with some references to exploits is this blogpost. Refers to past vBulletin and phpMyAdmin exploits which were caused by improper Eval usage.
补充：另一篇关于漏洞利用的好文章是这篇博文。指过去由于 Eval 使用不当引起的 vBulletin 和 phpMyAdmin 漏洞。
回答by Erik van Brakel
Easy:
简单：
$x // your variable with the data from the DB
<?php echo eval("?>".$x."<?") ?>
Let me know, works great for me in MANY applications, can't help but notice that everyone is quick to say how bad it is, but slow to actually help out with a straight answer...
让我知道，在许多应用程序中对我来说都很好用，不禁注意到每个人都很快说它有多糟糕，但实际上帮助直接回答的速度很慢......
回答by Micha? Rudnicki
eval()function was covered in other responses here. I agree you should limit use of evalunless it is absolutely needed. Instead of having PHP code in db you could have just a class name that has method called, say, execute(). Whenever you need to run your custom PHP code just instantiate the class of name you just fetched from db and run ->execute()on it. It is much cleaner solution and gives you great field of flexibility and improves site security significantly.
eval()功能已在此处的其他回复中介绍。我同意你应该限制使用，eval除非绝对需要。除了在 db 中包含 PHP 代码之外，您还可以只使用一个类名来调用方法，例如execute(). 每当您需要运行自定义 PHP 代码时，只需实例化您刚刚从 db 获取的名称类并->execute()在其上运行即可。它是更清洁的解决方案，为您提供了极大的灵活性，并显着提高了站点安全性。
回答by Vegard Larsen
回答by dkretz
Have you considered using your Source Control system to store different forks for the various installations (and the modules that differ among them)? That would be one of several best practices for application configuration I can think of. Yours is not an unusual requirement, so it's a problem that's been solved by others in the past; and storing code in a database is one I think you'd have a hard time finding reference to, or being advised as a best practice.
您是否考虑过使用源代码控制系统为各种安装（以及它们之间不同的模块）存储不同的分支？这将是我能想到的应用程序配置的几个最佳实践之一。你的要求不是特别的，所以过去别人已经解决了这个问题；将代码存储在数据库中是一种我认为您很难找到参考或被建议作为最佳实践的方法。
Good thing you posted the clarification. You've probably unintentionally posed an answer in search of a suitable question.
还好你发布了澄清。您可能无意中提出了一个寻找合适问题的答案。
回答by Khaptin
How I did this is to have a field in the database that identified something unique about the block of code needing to be executed. That one word is in the file name of that code. I put the strings together to point to the php file to be included. example:
我这样做的方法是在数据库中有一个字段，用于标识需要执行的代码块的独特之处。那个词在那个代码的文件名中。我将字符串放在一起指向要包含的 php 文件。例子：
$lookFor = $row['page'];
include("resources/" . $lookFor . "Codebase.php");
In this way even if a hacker could access you DB he couldn't put malicious code straight in there to be executed. He could perhaps change the reference word, but unless he could actually put a file directly onto the server it would do him no good. If he could put files directly onto the server, you're sunk then anyway if he really wants to be nasty. Just my two cents worth.
这样，即使黑客可以访问您的数据库，他也无法将恶意代码直接放入其中以供执行。他或许可以更改参考词，但除非他真的可以将文件直接放到服务器上，否则这对他没有好处。如果他可以将文件直接放在服务器上，那么无论如何如果他真的想变得讨厌，你就会沉没。只值我的两分钱。
And yes, there are reasons you would want to execute stored code, but there are cons.
是的，您有一些原因想要执行存储的代码，但也有缺点。
回答by ashkufaraz
Read php code from database and save to file with unique name and then include file this easy way for run php code and debug it.
从数据库中读取 php 代码并保存到具有唯一名称的文件中，然后以这种简单的方式包含文件以运行 php 代码并对其进行调试。
$uniqid="tmp/".date("d-m-Y h-i-s").'_'.$Title."_".uniqid().".php";
$file = fopen($uniqid,"w");
fwrite($file,"<?php \r\n ".$R['Body']);
fclose($file);
// eval($R['Body']);
include $uniqid;
