Embedding PHP inside PHP

Question

I have recently put up a server, and I am making changes gradually. One of the changes is the contents of a php page. I commonly use a php "shell" (just a textarea and the php just evals what is written). I have made some changes and want to use

fwrite($file, "<?php php here ?>");

but i am getting an error. I believe I know the problem, and it is because i have nested php like

<?php
$a = fopen('../php.php', 'w');
fwrite($a, "
<?php
eval($_POST['phptorun']);
?>
");
fclose($a);
?>

Is there any way I can get it to just put that php code into the file php.php?

The error i was getting is:

Parse error: syntax error, unexpected '' (T_ENCAPSED_AND_WHITESPACE), expecting identifier (T_STRING) or variable (T_VARIABLE) or number (T_NUM_STRING) in /var/www/html/Tyler/replace.php on line 5

Edit:

I forgot to say a couple of things. The server is a LAMP (Linux Apache MySQL PHP), running on my Raspberry Pi 2, model B. If you want to visit my server, it is at 71.204.114.18

check this link http://stackoverflow.com/questions/12173473/echo-a-string-in-php-that-contains-or-php-and-a-php-function/37520814#37520814 — Megan Fox, Jun 08 '16 at 08:09
Possible duplicate of [how to write php code to a file with php](http://stackoverflow.com/questions/17029917/how-to-write-php-code-to-a-file-with-php) — eol, Jun 08 '16 at 08:11
@RiggsFolly the i am using php to replace the php in a different file, that different file eval'ing code written in a textarea — Tyler Richardson, Jun 08 '16 at 08:12
You realise that concept allows US to write any php code to your server and is **incredibly dangerous** — RiggsFolly, Jun 08 '16 at 08:18
@RiggsFolly yes, but the server is just a small private server for me and my friends, and thats the reason i have it running on an rpi, theyre inexpensive — Tyler Richardson, Jun 08 '16 at 08:20
Just so I'm clear - you are wanting to write `eval( whatever code was in the text box coming from $_POST )` or you want to literally write `eval($_POST['phptorun'])`...? — ImClarky, Jun 08 '16 at 08:20
@ImClarky fbo3264's answer solved my question, im waiting on the time limit to expire so i can accept it — Tyler Richardson, Jun 08 '16 at 08:21
**You had better put some security (at least a login) on there right now.** — RiggsFolly, Jun 08 '16 at 08:24
And delete the 2 files I just added. Nothing nasty in them but just to prove the point. — RiggsFolly, Jun 08 '16 at 08:27
Is there any way i can delete a directory without it having to be empty? — Tyler Richardson, Jun 08 '16 at 08:32

score 2 · Accepted Answer · answered Jun 08 '16 at 08:09

2

Try to escape the $ symbol:

<?php
$a = fopen('../php.php', 'w');
fwrite($a, "
<?php
eval(\$_POST['phptorun']);
?>
");
fclose($a);
?>

answered Jun 08 '16 at 08:09

eol

23,236
5
46
64

Embedding PHP inside PHP

1 Answers1