echo string with php tags

[easypro]

I have a php page (page1.php) that loads another php page (page2.php).
with page2.php I have other php codes and "includes" that I want to work.
I use content=file_get_contents(file_path/page2.php) to get the code from page2.php.
I then use str_replace() to change the file path of the "includes()" on page2.php so that they are relative to page1.php
then I echo my content but it does not show up.
when I view the source code, it's all there and correct, but it's not rendering or executing or whatever on the page.

Here is some sample code form page2.php:
<div id="header"><? include("pages/header.php"); ?></div>

Here is my code on page1.php:
$Content = file_get_contents("../folder/page2.php");
$Content = str_replace('pages/','../folder/pages/',$Content);
- this fixes my file path from page1.php to header.php
echo $Content;

I have been at this all day and google has not helped.
somebody has to know how to do this.
please help!

[diafol]

use include not file_get...

you can use a variable in your folder paths instead:

$folder = "../folder/";
include "../folder/page2.php";

in your page2.php

//start of file:
<? if(!isset($folder)) $folder = '' ?>

<div id="header"><? include($folder . "pages/header.php") ?></div>

However have a look at __FILE__ and __DIR__ in the manual

[easypro]

page2.php actually represents all the template files and I would prefer not to have to change those.
I actually got it to work by using this:
$Content = file_get_contents("../folder/page2.php");
$Content = str_replace('pages/','../folder/pages/',$Content);
$Content = "?> ".$Content;
eval($Content);

but now I am left with one more problem.
as I mentioned, my page2.php has PHP code like this:
<div id="header"><? include("pages/header.php"); ?></div>
which loads the header.php
well the header.php has image files with relative paths from page2.php, but not page1.php so they don't show up on page1.php.
I can't do the str_replace() thing down on this level
the only reason I can do it for the initial $Content is because I am executing the PHP code with "eval" and once it's executed, it prints to the page, so you can't call str_replace() or any other function after that.
I tried loading the eval($Content); into another variable, but that didn't work.
what can I do?

[diafol]

Just so that you know, file_get_contents() is NOT the way to do it and eval() is certainly not a function you want to be using unless you can avoid it.

You could supply an absolute dir in all your paths, which would be by far the easiest method:

in your config file if you have one

define('ROOT', '...absolute path...');

in your page1.php

$Content = include ROOT . 'folder/page2.php';

in your page2.php

<div id="header"><? include ROOT . "pages/header.php"; ?></div>

But, you don't want to do this. AFAICS you only need to do a find and replace patterns like:

include(" -> include(ROOT . "

and such like. Do you have that many templates that the replacement would be prohibitive?

[easypro]

Thank you diafol. your time is appreciated. It's not just a lot of templates, I have over 100 customers already using my cms so I don't want to have to go into each one of there files on the server to make changes. I actually just ended up using javascript for the image file paths:

var oldContent= document.getElementById('content').innerHTML;
var newContent = oldContent.replace(new RegExp("images/", "g"), "../folder/images/");
document.getElementById('content').innerHTML = newContent;

so everything is working now.
but I really do wonder why you don't recommend file_get_contents() and eval().

[diafol]

OK,

What you're doing is including or requiring (if essential to your page) a file. It's not exactly the same as getting the contents of the file [fgc], which just returns a string (including 'unrun' php code). That's why you then have to run eval() on it.

Sure fgc will be quicker than include, but only because it hasn't 'done' anything with any of the php. include (or require) actually process the code too.

eval() is evil() :)

If you can vouch for all the code passed to eval() it may not be so bad, but it's a massive security problem most of the time. The killer for me is the 'return' terminator. Sometimes files contain trivial specialist functions which may have 'return' in them. When eval() reaches this, the evaluation stops. It also forces you to use short tags - this may or may not be a problem for your server settings.

So in short, include and fgc have different uses. I believe that you want the former if you're retrieving a mix of html and php. To anybody else - if I'm wrong, please let us know - I'm no expert. A second opinion is always useful.

//EDIT

WRT a live site. If you have 'clients' or users that are using it, then setting up a development site could be worthwhile. You can tinker to your heart's content. If you find your code works, download and FTP to the live site. If you're concerned you can give users notice that your site will be down for an hour for maintenance at a certain date and time. Obvioulsy backup any files before overwriting. It may also be worthwhile using something like SVN, where you can track revisions/versions and rollback if things aren't right.

[almostbob]

agree with diafol, can't depend on the un-intended use of a function, that may be altered in the future.
A kludge-fix is going to be very much harder to fix again when the operation of FGC is changed just a little by prospective future security revision
revision of the config system of the program will actually be easier than the next kludge