why does php if statement work when it's completely spelled out, but not when part of the spelling is a variable?

Question

this works:

if ( strtolower($make)=="toyota" && ( strpos(strtolower($model), "scion") !== false || strpos(strtolower($model), "scoin") !== false || strtolower($model) == "xa" || strtolower($model) == "xb" || strtolower($model) == "tc" || strtolower($model) == "xd" || strtolower($model) == "iq" || strtolower($model) == "fr-s" || strtolower($model) == "ia" || strtolower($model) == "im" ) ){
    //turn make into scion
    $make = "scion";
}

this doesn't work

$db_scion_models = "";
$scion_models_result = mysqli_query($conn,"SELECT DISTINCT vehicle_model_name FROM mod_vehicle_models WHERE mod_vehicle_make_id = '41' "); //41=scion
while ($scion_model_row = mysqli_fetch_assoc($scion_models_result)) {
    $db_scion_models .= '|| strtolower($model) == "'.$scion_model_row['vehicle_model_name'].'" ';
}
if (!empty($db_scion_models)) {
    $db_scion_models = 'strpos(strtolower($model), "scion") !== false || strpos(strtolower($model), "scoin") !== false '.$db_scion_models;
} else {
    $db_scion_models = 'strpos(strtolower($model), "scion") !== false || strpos(strtolower($model), "scoin") !== false';
}
if ( strtolower($make)=="toyota" && ( $db_scion_models ) ){
    //turn make into scion
    $make = "scion";
}

if statement has variable to try and make it dynamic. the following happens:

these convert to scion properly:
toyota FR-S
toyota iA
toyota iM
toyota tC

these convert to scion but shouldn't:
toyota 4runner
toyota avalon
toyota camry
toyota corolla
toyota highlander
toyota prius

if statement is spelled out in a static way. the following happens:

these convert to scion properly:
toyota FR-S
toyota iA
toyota iM
toyota tC

these don't convert to scion:
toyota 4runner
toyota avalon
toyota camry
toyota corolla
toyota highlander
toyota prius

I want dynamic and static way to work the same. What am i doing wrong?

Edit...

so do it like this?

$db_scion_models_array = array();
$scion_models_result = mysqli_query($conn,"SELECT DISTINCT vehicle_model_name FROM mod_vehicle_models WHERE mod_vehicle_make_id = '41' "); //41=scion
while ($scion_model_row = mysqli_fetch_assoc($scion_models_result)) {
    $db_scion_models_array[]=$scion_model_row['vehicle_model_name'];
}
if ( strtolower($make)=="toyota" && in_array(strtolower($model), $db_scion_models_array, true) ) {
    //turn make into scion
    $make = "scion";
}

...strings being executed would be a very dangerous practice. Consider if a user had written `exec('rm -rf /')` into a DB field and then you fetched that, server deleted (assuming server had poor permissions set up on it) — user3783243, Mar 23 '23 at 17:13
If you have a dynamic list of things to check for then put them all in an array and use in_array() to search for matches — ADyson, Mar 23 '23 at 17:16
that var_dump made this happen: func.php:941:boolean false func.php:941:string 'strpos(strtolower($model), "scion") !== false || strpos(strtolower($model), "scoin") !== false || strtolower($model) == "xa" || strtolower($model) == "xb" || strtolower($model) == "tc" || strtolower($model) == "xd" || strtolower($model) == "iq" || strtolower($model) == "fr-s" || strtolower($model) == "ia" || strtolower($model) == "im" ' (length=337) — leoarce, Mar 23 '23 at 17:21
OK. What's your point? As far as php is concerned, that's just a piece of text in a variable. It's not treated as code. — ADyson, Mar 23 '23 at 17:28
@leoarce That comment was removed because I realized after you were trying to execute strings as code.. don't do that. There is a way to do this but as the manual states it is every dangerous and shouldn't be done. `The eval() language construct is very dangerous because it allows execution of arbitrary PHP code. Its use thus is discouraged. If you have carefully verified that there is no other option than to use this construct` note **you have carefully verified that there is no other option** — user3783243, Mar 23 '23 at 17:31
using eval gives this: Parse error: syntax error, unexpected end of file in func.php(833) : eval()'d code on line 1 — leoarce, Mar 23 '23 at 17:32
probably because, by itself alone, that isn't compilable code. Again...don't do it like this (ignore the duplicates above, it's not the best solution). — ADyson, Mar 23 '23 at 18:15
That looks more like a sensible approach. Have you tested it? — ADyson, Mar 23 '23 at 18:51
all those links to already answered question are not the answer, especially since everyone complains of eval method. i just did it the array way. — leoarce, Mar 23 '23 at 20:19

score 1 · Answer 1 · answered Mar 23 '23 at 17:14

PHP source code in a string is not the same as the result of evaluating PHP source code.

Compare a simplified version of your code:

$a = "a";
$b = "b";

$result = '$a === "a"';
$result = $result . '($b === "b")';
echo $result;

which gives 1.

…with an approach that uses PHP as PHP instead of as strings of PHP:

$a = "a";
$b = "b";

$result = $a === "a";
$result = $result && ($b === "b");
echo $result;

which gives $a === "a"($b === "b")

why does php if statement work when it's completely spelled out, but not when part of the spelling is a variable?

1 Answers1