Replace [diggin] with HTML code or PHP code

Question

I have this string

$s = 'Yo be [diggin = array("fruit"=> "apple")] scriptzors!';

which then gets checked by

$matches = null;
preg_match_all('/\[(.*?)\]/', $s, $matches);
var_dump($matches[1]);

but what I want it to do is the following, it should return the following

print "yo be";
$this->diggin(SEND ARRAY HERE);
print "scriptzors!";

EDIT to show issue with below answer

$s = 'Yo be [diggin = array("fruit"=>"apple")] scriptzors!';
$matches = null; 
preg_match_all('/\[(.*?)\]/', $s, $matches);

$var = explode(' = ', $matches[1]);
print $var[0]; //THIS DOES NOT PRINT

The return part is strange to me. What should your $s string be converted to ? — Glavić, Sep 23 '12 at 09:16
its just text, from our database, and i want to allow our staff to pur plugins or run functions inside the content which is a website. think like wordpress — RussellHarrower, Sep 23 '12 at 09:25
What does this "$this->diggin(SEND ARRAY HERE);" do? What does your output looks like when converted? — Glavić, Sep 23 '12 at 09:37

score 0 · Accepted Answer · edited May 23 '17 at 11:56

0

You're sort of close. You can explode the string with = but with spaces included around the =. Then the first element would be the function name, in this case diggin and the second element would be the array but as a string. You'll need to eval that one so that it'll be a proper array data type.

$var = explode(' = ', $matches[1][0]);
call_user_func_array(array($this, $var[0]), eval($var[1] . ';'));
// or do 
$this->{var[0]}(eval($val[1] . ';'));

As an alternative, you can also modify the regex so that you don't have to call explode.

preg_match_all('/\[([a-z0-9_]*)\s*?=\s*(.*)\]/i', $s, $matches);

Either way, you'll want to make sure that you sanitize the user input because eval can be ev il.

edited May 23 '17 at 11:56

Community

1
1

answered Sep 23 '12 at 09:41

Kemal Fadillah

9,760
3
45
63

Can I ask how do I make it put it in the correct part? that does the turn {} into function but what about the splitting of the content in the $s so the function is inserted where the {} is – RussellHarrower Sep 23 '12 at 09:52
You should split the content of `$s` for every "function call" you found in the string. When you've got everything (i.e. all functions are called), constitute back the strings that you split before. – Kemal Fadillah Sep 23 '12 at 09:59
for some reason its not getting the $var[0] – RussellHarrower Sep 23 '12 at 10:20
I have edited my answer to show issue with answer. Maybe I am doing it wrong – RussellHarrower Sep 23 '12 at 10:23
Ah, my bad. The right one is `$var = explode(' = ', $matches[1][0]);` – Kemal Fadillah Sep 23 '12 at 10:24
its still not turning the $var[1] into an array – RussellHarrower Sep 23 '12 at 10:55
That's what the `eval` is for. If you want to have `$var[1]` as an array. Simply call `eval` while assign `$var[1]` to the array string. `eval('$var[1] = '.$var[1].';');` – Kemal Fadillah Sep 23 '12 at 11:25

score 0 · Answer 2 · answered Apr 10 '13 at 12:08

This will call the function without using eval and exposing yourself to code injection.

preg_match_all('/\[([a-z0-9_]*)\s*?=\s*array\((.*)*\)\]/i', $s, $matches);
$var = explode(',', $matches[2][0]);
$result = array();
foreach ($var as $value) {
    $keyvaluepair = explode('=>', $value);
    $result[$keyvaluepair[0]] = $keyvaluepair[1];
}
$this->{var[0]}($result);

Replace [diggin] with HTML code or PHP code

2 Answers2