2016-08-02 61 views
0

我正在製作一個內容管理系統。我允許用戶通過一個可以在新頁面上使用的表單發佈一些信息(比如「頁面標題」和「輪播速度」),但我很努力地將這些信息輸入到生成的頁面。將POST數據輸出到<<<'EOT'

要添加我正在使用的網站的內容$page .= <<<'EOT'並將html放置在那裏,但試圖在此範圍內回顯$_POST變量意味着PHP代碼將在字面上出現,因爲我將它寫入EOT而不是作爲結果。

有沒有辦法告訴EOT將<?php echo $_POST['speed'] ?>視爲異常?

<?php 

    $addTo = $_POST['addTo']; 
    //$visit = $_POST['visit']; 
    $dir = $_POST['name']; 
    $desc = $_POST['desc']; 

    $dir = preg_replace('/\s+/', '_', $dir); 

    mkdir($addTo.'/'.$dir, 0777); 
    mkdir($addTo.'/'.$dir.'/photos', 0777); 

    //Make page 
    $content = "he"; 
    $myfile = fopen ($addTo.'/'.$dir.'/index.php', "w") or die ("Unable to open file!"); 
    $page = ""; 
    $speed = $_POST['speed']; 



$page .= <<<'EOT' 

<head> 
    <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css" integrity="sha384-BVYiiSIFeK1dGmJRAkycuHAHRg32OmUcww7on3RYdg4Va+PmSTsz/K68vbdEjh4u" crossorigin="anonymous"> 
    <script src="https://code.jquery.com/jquery-3.1.0.min.js" integrity="sha256-cCueBR6CsyA4/9szpPfrX3s49M9vUU5BgtiJj06wt/s=" crossorigin="anonymous"></script> 
    <script src="https://use.fontawesome.com/2c6a42bed3.js"></script> 
    <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js"></script> 
</head> 

<body> 

    <div id="myCarousel" class="carousel slide" data-ride="carousel"> 
     <!-- Indicators --> 
     <ol class="carousel-indicators" style="display:none"> 
     <li data-target="#myCarousel" data-slide-to="0" class="active"></li> 
     <li data-target="#myCarousel" data-slide-to="1"></li> 
     <li data-target="#myCarousel" data-slide-to="2"></li> 
     <li data-target="#myCarousel" data-slide-to="3"></li> 
     </ol> 

     <!-- Wrapper for slides --> 
     <div class="carousel-inner" role="listbox"> 

     <?php 

      $active = "active"; 
      $url = $_SERVER['REQUEST_URI'].'photos/'; 
      //echo $url." - url<br/>"; 

      $conn = mysqli_connect("localhost","root","","test"); 

      $sql = "SELECT speed FROM pages WHERE title = ''"; 

      if (mysqli_connect_errno()) {echo "Failed to connect to MySQL: " . mysqli_connect_error();} 
      $sql = "SELECT * FROM photos WHERE url = '$url'"; 

      $result = mysqli_query($conn, $sql); 

      while($row = mysqli_fetch_array($result)) { 
       ?> 
        <div class="item <?=$active?>"> 
         <img src="<?php echo $row['url'].$row['caption']; ?>"> 
        </div> 
       <?php 

       $active=""; 

      } 

      $conn->close(); 

     ?> 

     </div> 

     <!-- Left and right controls --> 
     <a class="left carousel-control" href="#myCarousel" role="button" data-slide="prev"> 
     <span class="glyphicon glyphicon-chevron-left" aria-hidden="true"></span> 
     <span class="sr-only">Previous</span> 
     </a> 
     <a class="right carousel-control" href="#myCarousel" role="button" data-slide="next"> 
     <span class="glyphicon glyphicon-chevron-right" aria-hidden="true"></span> 
     <span class="sr-only">Next</span> 
     </a> 
    </div> 




</body> 
<script type="text/javascript"> 
    $(document).ready(function(){ 
     $("#myCarousel").carousel({ 
      interval : 420, 
      pause: false 
     }); 
    }); 
</script> 

%s 

EOT; 


?> 
<?php 

    $output = sprintf($page, $speed); 
    echo $output; 

    fwrite($myfile, $page); 
    fclose($myfile); 

    $conn = mysqli_connect("localhost","root","","test"); 

    if (mysqli_connect_errno()) {echo "Failed to connect to MySQL: " . mysqli_connect_error();} 

    $sql = "INSERT INTO pages (title, type, description, active, speed) VALUES ('$dir', '$addTo','$desc' , '1', '$speed')"; 

    if ($conn->query($sql) === TRUE) { 
     echo "New record created successfully"; 
    } else { 
     echo "Error: " . $sql . "<br>" . $conn->error; 
    } 

    $conn->close(); 

    //Redirect 
    if (isset($visit)){ 
     //header('Location:index.php?newPage='.$addTo.'/'.$dir.'/'.$filename); 
    } 

    else { 
     //header('Location:index.php?newPage='.$addTo.'/'.$dir.'/'.$filename); 
    } 

?> 
+0

你如何在你的php echo聲明中連接。這很容易。 <?php echo'............................................. ........'。 $ _ POST [「速度」。 ....';你可以寫許多行php –

回答

1

有沒有辦法告訴EOT治療<?php echo作爲 例外?

不,沒有,除非您用"EOT"替換'EOT'。第一個(你當前使用的是)將所有內容視爲原始字符串。第二個工作與PHP中的雙引號一樣,所以字符串將被解析並且變量將被識別。

我會繼續按照原樣使用'EOT',並在字符串中插入佔位符%s。然後我會使用sprintf與值(see the docs

// the %s will be replaced later with your values 
$template = <<< 'EOT' 
The car has speed %s and a mileage of %s ... 
EOT; 

//build the args. Use htmlspecialchars to protect your users from 
// Cross-Site Scripting attacks 
$args = [ 
    htmlspecialchars($_POST['speed']), 
    htmlspecialchars($_POST['mileage']), 
    ... 
]; 

//insert the args into the template 
$output = sprintf($template, ...$args); 

echo $output; 

安全提示,以替換佔位符:因爲你輸出字符串的用戶送你回瀏覽器,你很容易受到Cross-Site Scripting (XSS) attacks:用戶可以得到你的網站執行她想要的任何代碼,因爲你使用她的輸入來構建頁面。我用htmlspecialchars()清理輸入以保護你。

+0

感謝你。當我在使用sprintf後回顯$輸出時,它顯示頁面應該看起來像一個非常破碎的版本(但%s顯示爲$ _POST值,因爲它應該),有沒有一種方法可以拋出在沒有發生這種情況的情況下輸出到實際EOT的數量?我覺得我缺少一小步。再次感謝。 – ERushforth

+0

@ERushforth我不能說爲什麼它沒有看到你的代碼不工作。我建議添加它作爲問題的更新並解釋那裏有什麼問題。 – BeetleJuice

+0

謝謝,只是編輯了那裏的代碼。現在我已經把%s放在了EOT之前的底部,但是它將在

相關問題