我制作了一个小脚本，允许用户在我的网站中构建他们的页面或联系表单，
但一些朋友告诉我他们想要添加一些 JS 脚本！
所以我考虑允许用户编辑 header.php 文件，
文件内容是 - 示例
<head>
<title>Mysite | user_name</title>
</head>
现在我有想法，
我将从真实文件（ header.php ）中获取副本
并允许用户编辑它
可编辑版本将是
<title>{Mysite} | {user_name}</title>
，然后， ，我将使用（ str_replace 函数）将 {mysite} 替换为我的网站标题变量
我的问题是！
如果用户发布了 php 代码
示例，
<head>
<title>{Mysite} | {user_name}</title>
<? include /// or echo 'error' or what ever ! ?>
//and some things others
</head>
那么php 代码可以工作吗？或者将被忽略并仅用作 html ？
如果有安全且好的另一种方法请告诉我！
谢谢
i have made an small script to allow users to build they page or contact form in my site
but some friends told me they want add some JS scripts !
so i thinking about allow users to edit header.php file
the file content is - Example
<head>
<title>Mysite | user_name</title>
</head>
Now i have idea
i will take a copy from the real file ( header.php )
and allow user to edit it
the editable version will be
<title>{Mysite} | {user_name}</title>
and then , i will use ( str_replace function ) to replace {mysite} by my site title varibal
MY Question is !
if the user posted a php code
example
<head>
<title>{Mysite} | {user_name}</title>
<? include /// or echo 'error' or what ever ! ?>
//and some things others
</head>
the php code will work ? or will be ignored and used as html only ?
if there is a secure and good another way please tell me !
thank you
发布评论
评论（2）
如果您的用户可以修改的
header.php文件包含在以下位置（使用require或include）你的 PHP 代码，然后，它包含的 PHP 代码将被执行。在你的情况下，我宁愿：
header.tpl这样的文件名，以表明该文件不包含 PHP 代码，但确实是某种模板。inclure/require来获取该模板文件的内容，而是使用简单的file_get_contents()。If the
header.phpfile, which your users can modify, is included (usingrequireorinclude) from your PHP code, then, the PHP code it contains will be executed.In your case, I would rather :
header.tpl, to indicate that this file doesn't contain PHP code, but is indeed some kind of template.inclure/requireto get the content of that template file, but a simplefile_get_contents().如果出于某种原因您仍然想使用
.php而不是对模板来说危险性较小的东西，那么您无论如何都应该清理用户输入，这样他们就不会利用它。也许您可以从
strip_tags()函数开始，并在那里使用allowable_tags参数If for some reason you still want to use
.phpand not something less dangerous for templates, then you should sanitize user input anyway so they don't exploit it.Perhaps you can start with
strip_tags()function and usingallowable_tagsargument there