PHP inside ezpages

[fakeDecoy]

brandtim's simple solution on page 1 works for me. But I'm having a problem pulling from the database on an EZ page that serves as a comparison page I have written about some products.

<?php echo 'test' . zen_get_products_display_price((int)$_GET['2206']); ?>

The above code inserted into the EZ page is commented out by zen-cart when the page is displayed. From the live page source:

<!--?php echo '$' . zen_get_products_display_price((int)$_GET['2206']); ?-->

[fakeDecoy]

I need to amend my previous post to say that the solution does NOT work for me. That's what happens when I try.

[fakeDecoy]

Bump. Any solutions?

[fakeDecoy]

Bump again. Am I the only one needing to pull pricing info on EZ pages?

I've studied TechBrat's posts several times, but I can't for the live of me figure out what the "allocode" he's talking about is for.

[fakeDecoy]

Nevermind! I don't know what I did wrong, but it's working now.

[gjh42]

"allocode" --> "allowcode". Amazing the trouble one missing letter early in a thread can cause:)

[fakeDecoy]

Is there a further modification to brandtim's excellent solution that can be done to allow a backslash in javascript code that I'm using in an EZPage? Zencart is removing the backslash in the replace function here and I believe is breaking my code in the process.

return decodeURIComponent(keyvaluepair[1].replace(/\+/g, ' '));

brandtim's solution to allow PHP code:

MODERATOR COMMENT: Adding eval() to arbitrarily execute random PHP or other code in the manner suggested here opens your site up to security risks.
USE AT YOUR OWN RISK.

I definately needed this feature. Here's an even simpler version.

Replace this:

<div><?php echo $var_pageDetails->fields['pages_html_text']; ?></div>

with this:

<div><?php eval(stripslashes('?>' . $var_pageDetails->fields['pages_html_text'])); ?></div>

This way you don't have worry about php being 'on' in the ezpage - you can make the code of the page html with php inside it (a lot easier).

Tim

[DivaVocals]

Right. All php file access inside the includes folder is off-limits to scripts running from a browser.
I strongly suggest from a security standpoint that EZ-Pages is the WRONG place to be injecting PHP code. Period.

Call a file in the root directory. If it's not written with enough security to be put there, then it ought not to be on your site at all.

Good morning.. I promise I am not trying to be a hard-head here, but I have a client who won't simply accept this answer. I've explained that EZ Pages are saved to the DB and we can't save executable code to the DB.. Would be able to provide me with something more I can take back to her so she will let this go once and for all..

[DrByte]

While the general principle still applies (don't enter programming code via admin screens), I can't give you one generic answer that could adequately arm you with suitable information to convince your client one way or another. Details of what exactly they want to accomplish (the end result), and why (the business goal they're trying to meet or the problem they're trying to solve), as well as why they're convinced that the solution they've come up with is the "right" one having forsaken all others, are all important pieces of information.

[DivaVocals]

While the general principle still applies (don't enter programming code via admin screens), I can't give you one generic answer that could adequately arm you with suitable information to convince your client one way or another. Details of what exactly they want to accomplish (the end result), and why (the business goal they're trying to meet or the problem they're trying to solve), as well as why they're convinced that the solution they've come up with is the "right" one having forsaken all others, are all important pieces of information.

I understand.. I'm just looking to find an explanation of the security risks involved with adding PHP code to EZ Pages since the explanations I've provided thus far (based largely on your prior posts) haven't convinced her yet that this is not a good idea.. **sigh**

The "business problem" she is trying to solve is that she wants to use a particular slideshow/gallery on her site and she wants to be able to add the slideshow code to ANY EZ Page on the site.. Adding it to the defined pages is not an issue, but she is INSISTING on being able to use EZ pages to add these slideshows to as well.. **sigh** I can create as many defined pages as she needs to do this, but she somehow seems to feel that she won't have "flexibility" if she can't use EZ Pages too..