using PHP include statements

[JayC]

I find PHP includes work in some parts of zencart and do not work in others.

As an example I use an include statement to pull in my welcome page.

However they do not work in any part of the products area.

Since it works in some areas and not in others, I assume it has been actively turned off in the product area.

Does anyone know the reason for this, and if it is possible to turn it back on for products?

My reason for asking this question is that the biggest part of maintaining a site is keeping my product listings up to date.

Being able to use a PHP include in the description area would save me hundreds if not thousands of man hours a year in maintaining my product listings, and markedly reduce the errors that inevitably creep in when I have a multi step process to update the listings

So my questions are two

1. Is the ability to use PHP includes in the product area deliberately turned off?
2. Is it possible to turn it back on?

Vegas Jay

[gjh42]

Define pages are PHP files, and can process PHP. Product descriptions are HTML content stored in the database, like ez-pages. It has been discussed in the forum how to enable PHP for ez-pages, but pointed out that there are security risks; a SQL injection attack could then run PHP and do even greater damage.

You can add an include to tpl_product_info_display.php to bring in your content files. Look at swguy's boilerplate tips, available through his website and referenced from his sig and possibly forum posts. This is intended to be used for information that applies to many products, but you could just as well use it with a different file for every product and edit an HTML file when you want to change it.

[JayC]

Look at swguy's boilerplate tips, available through his website.

I went to his website and was unable to find the boiler plate tips.

For reasons that seem important to me, I create an html page for every product.

I use EZ Products to create my product listings so if I could just use an include statement pointing to the html page it would be a real time saver when it comes time to do corrections or updates.

(especially since my primary supplier just got purchased by another company and I expect a lot of changes in the near future)

I have a little background in both HTML and PHP, I cannot really see the security risk in permitting PHP statements in the product pages, can you point me to where that has been discussed, it is probably obvious but old farts like myself often overlook the obvious.

Thanks for your reply

Vegas Jay

[gjh42]

PHP inside ezpages (Long thread.) The security risk is apparently with the eval() function.

Confirmation: can't use php in Product Descriptions? See post 10 for swguy's boilerplate link.