Including a PHP file, with variables in an Email message

PHP
1

I’m working on a PHP script that will run as a cron job and send out Emails if certain conditions are met. I want part of the Email message text to contain text from external PHP files which contain variables which are defined in the main script.
I have it so the text is included, but the variables are missing.
This is (part of) what I have:

$filename = $_SERVER["DOCUMENT_ROOT"] . "/includes/".$filevar.".php";
    $inc = file_exists($filename);
    if ($inc == true) {
        $info = file_get_contents($filename);
    }
$message = '<html>
    <body>
    <h1>Message Heading</h1>
    <p>First part of message.</p>';
    $message .= $info ; // The bit I want the file including
    $message .= '<p>Last part of message.</p>
    </body>
    </html>';

The files I want to include are html with some PHP in it, like this:

<p>Some text <?php echo $var1 ; ?> some more text <?php echo $var2 ; ?> a bit more text.</p>

How do I get this to work?

2

eval() should do it. but the more elegant version would be to use a templating system.

3

Thanks.
I will give eval a try for now, but may re-think my system in future.
Looking at it in the PHP Manual, there is a lot warning away from using it. Is it really dangerous?
I guess if I control what goes into it, there should not be a risk.

4

I can’t get it to work with eval, I’m not sure if I’m using it right.
This is what I have to get the info from the file:

$filename = $_SERVER["DOCUMENT_ROOT"] . "/includes/".$filevar.".php";
    if (file_exists($filename)) {
        $info = file_get_contents($filename);
        $info = eval($info);
    }
    else {
        $info = '<p>The information could not be found.</p>';
    }

Then construct the message like this:

$message = '<html>
    <body>
    <h1>Message Heading</h1>
    <p>First part of message</p>';
    $message .= $info ; // where I want the file inserting
    $message .= '<p>Last part of message.</p>
    </body>
    </html>';

I read in the manual about eval that you must not enclose in php tags, but may escape them for non-php, html content. So I tried a closing php tag at the beginning and an opener at the end, like this in my include file:

?><p>Some text <?php echo $var1 ; ?> some more text <?php echo $var2 ; ?> a bit more text.</p><?php

Either way, it does not work, the middle part of the message (from the file) is missing altogether now.

5

I haven’t used eval(), but a quick look at the manual suggests that you’re using it incorrectly. Their example (from http://php.net/manual/en/function.eval.php) is:

<?php
$string = 'cup';
$name = 'coffee';
$str = 'This is a $string with my $name in it.';
echo $str. "\n";
eval("\$str = \"$str\";");
echo $str. "\n";
?>

and it says on there that eval() returns NULL unless you specifically use the return statement. Perhaps this:

$message = '<html>
    <body>
    <h1>Message Heading</h1>
    <p>First part of message.</p>
    $info
    <p>Last part of message.</p>
    </body>
    </html>';
if (file_exists($filename)) {
        $info = file_get_contents($filename);
        eval("\$msg = \"$message\";");
    }
6

You can just use include:

ob_start();
include($filename);
$info = ob_get_clean();

$message = '<html>
    <body>
    <h1>Message Heading</h1>
    <p>First part of message.</p>';
    $message .= $info;
    $message .= '<p>Last part of message.</p>
    </body>
    </html>';

Basically ob_start starts a buffer, which will capture all output. So instead of printing the data, it will be saved to the buffer. ob_get_clean will return the contents of that buffer and then clean the buffer (to free up the memory).

Please remember that eval is the last function you want to use in PHP, if you really have to it’s probably time to go back to the drawing board because something went horribly wrong!

7

Also, as you seem to be taking variable input for a filename, be VERY VERY CAREFUL with what you accept; you may find some ill-intentioned person decides to put some .'s and /'s in and suddenly you’re putting your passwd file into an email.

8

Thanks for the answers. I had seen warnings about using eval. With that and the fact I never got it to work, I have devised a different system to do the job without using eval which I now have working.

9

I’ve only had to use eval once. I found it very difficult to get it to work correctly and IMHO it’s best to avoid it whenever possible and only use it as a last resort.