Best way to store html in a config file - php

Question

I am writing my own download tracker and i want to offer users the ability to show a custom message on the download page. I want to allow html and javascript, so users can write a paragraph or use an ad code etc.
I am storing my settings in a config file (not the best way I know)
Example: <?php define("WAIT_MESSAGE", "htmlcodehere"); ?>
The problem is that quotes or slashes mess up the config file and the settings page will not load. I've looked into add slashes to try and escape these characters but it just adds multiple slashes.
What would be the best way to store html content/javascript in my config file?
EDIT: Have tried a few methods, but with all them quotes are escape each time i click save to update the config file \"hello\" becomes \"hello\" etc

Answer 1

You should NOT trust your users so mutch that you let them post and save JavaScript and HTML on your site.

Answer 2

Allowing users to actually insert HTML/Javascript/PHP in to your page is a very bad thing to do
Having said all that the problem is one that plagues us all from time to time. What you need is to store the HTML code in some format that is not going to change the meaning of the code above.
This problem is usually resolved by converting any such characters to their equivalent HTML entities so that you can safely store the
Take a look at http://php.net/manual/en/function.htmlspecialchars.php and http://www.php.net/manual/en/function.htmlspecialchars-decode.php for more info.

Answer 3

Have you tried it like with single ' ?
<?php define('WAIT_MESSAGE', '<p>Please wait.. your download starts shortly</p>'); ?>

Answer 4

That is not safe at all. Someone could easily inject PHP into it.
What you can do (which is a bit hacky), is to base64_encode() the data, and base64_decode() it when you need to use it. Doing that will get rid of the quotes/special characters problem, and the security problem.
Once you've written the base64_encoded HTML in the config file, to use it, you'll do:
<?php
echo base64_decode(WAIT_MESSAGE);
?>

Answer 5

Personally I would hold any editable values within a database to be safe,
but if you really want/need to edit a php config file then perhaps this is the safest way.
<?php
/*Function to check if magic_quotes is enabled.
(Stops double slashes happening)
*/
function check_magic_quotes($value){
if (get_magic_quotes_gpc()) {
return stripslashes($value);
} else {
return $value;
}
}
/*Form was posted,
You should also do a check to see if logged in and have rights to edit*/
if($_SERVER['REQUEST_METHOD']=='POST'){
//Check for magic quotes and then base64_encode the string.
$value = base64_encode(check_magic_quotes($_POST['configVal']));
/*Use heredoc to create the php line for the config & insert the
base64 encoded string into place*/
$config=<<<CONFIG
<?php define("WAIT_MESSAGE", '$value'); ?>
CONFIG;
file_put_contents('someConfig.php',$config);
}
//When you want to include the config
include('someConfig.php');
/*To echo out the config value: base64_decode it,
and then htmlentities encode it, to protect from XSS*/
echo 'This was included: '.htmlentities(base64_decode(WAIT_MESSAGE));
//Basic form with current value when someConfg.php has not been included
$config = file_get_contents('someConfig.php');
preg_match("#\"WAIT_MESSAGE\", '(.*?)'#",$config,$match);
?>
<form method="POST" action="">
<p>Config Value:<input type="text" name="configVal" value="<?php echo htmlentities(base64_decode($match[1]));?>" size="20"><input type="submit" value="Update"></p>
</form>