Alternatives to eval() - Shortcodes in text input - php

Question

in a CMS I want the user to be able to include blocks of php code like a contact form, a search form.
Something like
<? include 'contact.inc.php' ?>
Now, Wordpress does this by using Shortcodes, ie
[contact-form] [search form]
How can I do this easily?
I have a limited number of includes
I could use
eval('?> ' . $database_query . ' <?php ');
and put
<? include('contact.inc.php') ; ?>
in the contents of $database_query
but eval() in this situation is dangerous
so how can I make a simple shortcode system ?

Answer 1

I would avoid eval all together if you can. The issue with eval, particularly with form inputs is that if exploited, you are giving an attacker access to your entire web server. I would suggest using some server-side script that is looking for explicit shortcodes. You can even use the Wordpress function that they use as a starting point. You can also use a preg_match to search for your shortcodes in the text and parse them that way. Either option would be better than eval()

Answer 2

Assuming you've loaded some HTML with your shortcodes from somewhere (database for example) and you want to echo it's contents with your forms inside, I would do the following:
// Define known shortcodes
$shortcodes = array(
"[contact-form]" => "contact.inc.php",
"[search-form]" => "search.inc.php"
);
// Load HTML with shortcodes from wherever you want
$source = load_template_from_somewhere();
// Now let's find the shortcodes in your source
$replace_points = array();
foreach($shortcodes as $code => $include_me){
$offset = 0;
while(TRUE){
$index = strpos($source, $code, $offset);
if($index === FALSE){
// No more shortcodes of this type found
break;
};
// Save the position and name of shortcode
$replace_points[$index] = $code;
// Update offset to scan the source search the remaining part of the string
$offset = $index + strlen($code);
};
};
// Sort the array because we've been searching by shortcode names
// And now we need to include forms in the correct order
ksort($replace_points);
$offset = 0;
foreach($replace_points as $index => $code){
// Echo raw HTML part of the string
echo substr($source, $offset, $index);
// Then include the form
include($shortcodes[$code]);
// Update the offset to move towards the end of the string
$offset = $index + strlen($code);
};
// Echo the remaining part of raw HTML string
echo substr($source, $offset);