Re: Re: addslashes vs string unescape

On Mon, 12 Jul 2004 19:32:59 +0300, Skippy <skippy@zuavra.net> wrote: > On Mon, 12 Jul 2004 17:15:15 +0200 Daniel Kullik <kullik@wwe.biz> wrote: > > Skippy wrote: > > Can you use this? > > It seems to work, at first test, but it's somewhat convoluted. I've found > another fairly reasonable solution: using $val instead of %val%. This way I > don't need to ever show the actual contents of the random string in the > eval() and the problem becomes void. > > I said "fairly reasonable" because it will still require a painful porting > period and letting people know they should move to $val, but in the long run > it will work. Here's a lesson about not testing well enough before deploying. > > Thank you for the help just the same. > Assuming the formatting string is in $formatString and the random string is in $randomString: $evalStr = str_replace('%val%', '$randomString', $formatString); $result = eval('return '.$evalStr); No need to change the way that users format their format string. -- DB_DataObject_FormBuilder - The database at your fingertips http://pear.php.net/package/DB_DataObject_FormBuilder paperCrane --Justin Patrin--