There is a code stored in the database:

<?php require_once 'includes/global.inc.php'; $username = ""; $password = ""; $password_confirm = ""; $email = ""; $error = ""; if(isset($_POST['submit-form'])) { $username = $_POST['username']; $password = $_POST['password']; $password_confirm = $_POST['password-confirm']; $email = $_POST['email']; $success = true; $userTools = new UserTools(); if($userTools -> checkUsernameExists($username)) { $error .= "That username is already taken.<br/> \n\r"; $success = false; } if($password != $password_confirm) { $error .= "Passwords do not match.<br/> \n\r"; $success = false; } if($success) { $data['username'] = $username; $data['password'] = md5($password); $data['email'] = $email; $newUser = new User($data); $newUser->save(true); $userTools -> login($username, $password); header("Location: welcome.php"); } } ?> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <link rel="stylesheet" href="forma.css" type="text/css"> </head> <body> <form action="registration.php" method="POST" id="loginform"> <div class="field"> <label>Имя пользователя:</label> <div class="input"><input type="text" value="<?php echo $username;?>" name="username"></div> </div> <div class="field"> <label>Пароль:</label> <div class="input"><input type="password" value="<?php echo $password;?>" name="password"></div> </div> <div class="field"> <label>Подтверждение пароля:</label> <div class="input"><input type="password" value="<?php echo $password_confirm;?>" name="password-confirm"></div> </div> <div class="field"> <label>E-mail:</label> <div class="input"><input type="text" value="<?php echo $email;?>" name="email"></div> </div> <div class="submit"> <button type="submit" value="Register" name="submit-form">Зарегистрироваться</button> </div> </form> </body> </html> 

The fact is that I need to bring it to the page. But for some reason, the whole thing is displayed only up to the symbol of the call to the class method:

 $userTools = new UserTools(); if($userTools -> checkUsernameExists($username)) 

After the arrow, the code is read by the browser as plain text and is thus displayed on the page. How to deal with it?

UserTools:

 <?php require_once 'User.class.php'; require_once 'DB.class.php'; class UserTools { public function login($username, $password) { $hashedPassword = md5($password); $result = mysql_query("SELECT * FROM user WHERE username = '$username' AND password = '$hashedPassword'"); if(mysql_num_rows($result) == 1) { $_SESSION["user"] = serialize(new User(mysql_fetch_assoc($result))); $_SESSION["login_time"] = time(); $_SESSION["logged_in"] = 1; return true; }else{ return false; } } public function logout() { unset($_SESSION['user']); unset($_SESSION['login_time']); unset($_SESSION['logged_in']); session_destroy(); } public function checkUsernameExists($username) { $result = mysql_query("select id from user where username='$username'"); if(mysql_num_rows($result) == 0) { return false; }else{ return true; } } public function get($id) { $db = new DB(); $result = $db->select('user', "id = $id"); return new User($result); } } ?> 
  • What does it mean to "bring" to the page? Exactly to withdraw or still execute and display the result? - Dmitriy Simushev
  • @ AlekseyGerasimov, maybe you should screen the text before saving to the database? - Visman
  • @DmitriySimushev no, execute and output. - Alexey Gerasimov
  • Are there any mistakes? In apache error.log? I think now is the time to stop using md5, if there are no options then go to sha1. A better php.net/manual/en/function.hash.php or php.net/manual/en/function.password-hash.php - E_p
  • one
    I now wonder why the php code should be processed if it gets as plain text? Here you get it all from the base and then what, is it output via echo or how? How are you putting it in? - Alexey Shimansky

1 answer 1

Do not store the code in the database. Never do that. There are a lot of options for template collectors for this, from XML to object. Try to screen the symbol -> like this -\> , see what the page displays.

  • At first I tried to replace '$ userTools -> checkUsernameExists ($ username)' with true, the code began to be read exactly to the next one ->. And if screened, then everything is still. - Alexey Gerasimov
  • Try to download the code, and see what kind of characters it issues in places -> . Replicate interpretation curves, if anything - SLy_huh