Can I do a mysql_query in eval()?

Question

The community builder I am using requires php blocks to be parsed through eval(). Can I use the mysql_query in eval? If not how can I call info from the database in this eval()?

Here's my code so far:

$iProId = $this->oProfileGen->_iProfileID;
$sCat = mysql_query("SELECT genres from Profiles WHERE ID = ". $iProId);
print_r($sCat);

This gives me:
Resource id #167

Why, exactly, do you need to do this? Both the [`eval`](http://stackoverflow.com/questions/951373/when-is-eval-evil-in-php) and interpolating a value directly into the query string are potentially huge security holes. There's usually a safer, more performant and more maintainable way than either technique. For SQL statements, use [prepared statements](http://php.net/PDO.prepared-statements) (which means switching to a MySQL extension that supports them, such as PDO). The creator of PHP once said "If eval() is the answer, you're almost certainly asking the wrong question." — outis, Jul 20 '11 at 00:03

score 2 · Answer 1 · answered Jul 19 '11 at 23:03

If that code gave you that result when eval'd then yes, you can use mysql_query in eval and the rest of your question boils down to how you would have to use that result set.

In that case I would suggest something like:

$iProId = $this->oProfileGen->_iProfileID;
$sCat = mysql_query("SELECT genres from Profiles WHERE ID = ". $iProId);
while($row = mysql_fetch_assoc($sCat)) {
    print_r($row);
}

To loop over all rows in the resultset. If you want to know more the PHP website has all the goods on how to use mysql_* functions.

score 0 · Answer 2 · answered Jul 19 '11 at 23:02

0

Have a look at mysql_fetch_array (and the other mysql_fetch_* functions) for how to get your data from the resource.

answered Jul 19 '11 at 23:02

cmbuckley

40,217
9
77
91

score 0 · Answer 3 · answered Jul 19 '11 at 23:04

Using a query in eval() sounds strange to me, but you code is working right. mysql_query returns a mysql resource. Then you need to you mysql_fetch_array, mysql_fetch_row, or mysql_fetch_assoc to read it like:

$iProId = $this->oProfileGen->_iProfileID;
$result = mysql_query("SELECT genres from Profiles WHERE ID = ". $iProId);
$sCat = mysql_fetch_assoc($result);
print_r($sCat);

Can I do a mysql_query in eval()?

3 Answers3