Hiding php codes from file_get_contents method - php

Question

I am sending email with PHPMailer. My email design is available in the template.php file. I am pulling the contents of the template.php file with the file_get_contents method in my mail.php file. But I have such a problem, all my php codes in the template.php file are also visible. How can I hide them?
Mail.php
<?php
// Import PHPMailer classes into the global namespace
// These must be at the top of your script, not inside a function
use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\Exception;
require 'PHPMailer/src/Exception.php';
require 'PHPMailer/src/PHPMailer.php';
require 'PHPMailer/src/SMTP.php';
require_once 'assets/standart/db.php';
require 'assets/class/all.php';
$connect = new baglan();
$settings = new ayarlar();
// SMTP settings connect
$connect->connect('settings_smtp', '', '', 0);
$smtp_settings = $connect->connect->fetch(PDO::FETCH_ASSOC);
$smtp_mail = $smtp_settings['mail'];
// /SMTP settings connect
$template_file = 'PHPMailer/template.php';
if(file_exists($template_file)){
$mail_template = htmlspecialchars(file_get_contents($template_file));
}else{
die("Unable to locate the template file");
}
//Load Composer's autoloader
// require 'vendor/autoload.php';
//Create an instance; passing `true` enables exceptions
$mail = new PHPMailer(true);
try {
//Server settings
$mail->SMTPDebug = 0;
$mail->isSMTP();
$mail->Host = $smtp_settings['host'];
$mail->SMTPAuth = true;
$mail->Username = $smtp_settings['mail'];
$mail->Password = $smtp_settings['password'];
$mail->SMTPSecure = PHPMailer::ENCRYPTION_SMTPS;
$mail->Port = $smtp_settings['port'];
//Recipients
$mail->setFrom("$smtp_mail", 'Mailer');
$mail->addAddress('example#gmail.com', 'Joe User'); //Add a recipient
// $mail->addAddress('ellen#example.com'); //Name is optional
// $mail->addReplyTo('info#example.com', 'Information');
// $mail->addCC('cc#example.com');
// $mail->addBCC('bcc#example.com');
//Attachments
// $mail->addAttachment('/var/tmp/file.tar.gz'); //Add attachments
// $mail->addAttachment('/tmp/image.jpg', 'new.jpg'); //Optional name
//Content
$mail->isHTML(true);
$mail->CharSet = 'UTF-8';
$mail->Subject = 'Here is the subject';
$mail->Body = $mail_template;
$mail->AltBody = 'This is the body in plain text for non-HTML mail clients';
$mail->send();
echo 'Message has been sent';
} catch (Exception $e) {
echo "Message could not be sent. Mailer Error: {$mail->ErrorInfo}";
}
Template.php
<?php
echo $forexample = 'Some words here';
?>

Answer 1

Don’t use file_get_contents for that, use include with output buffering. That way it will run the PHP code and you’ll see the results of its execution instead of the code itself.

Answer 2

You have to run the template file, not simply read it.
You can do that like this:
ob_start();
include ( $template_file );
$mail_template = ob_get_clean();
ob_start() (output-buffer start) causes all php script output (from echo etc) to go into an output buffer. output_get_clean() retrieves that output.

Answer 3

With
$mail_template = htmlspecialchars(file_get_contents($template_file));
you will just get the contents of the file into the variable $mail_template
You could use the eval() function as described here: https://www.php.net/manual/en/function.eval.php
But be very careful using it!
Caution: The eval() language construct is very dangerous because it allows
execution of arbitrary PHP code. Its use thus is discouraged. If you
have carefully verified that there is no other option than to use this
construct, pay special attention not to pass any user provided data
into it without properly validating it beforehand.
You could use it like this:
$mail_template_php = htmlspecialchars(file_get_contents($template_file));
$mail_template = eval($mail_template_php);