0

I am doing some SQL queries in a WordPress page using the Insert PHP plugin, but the -> object operator changes to -> when I write code in the Text editor, or view in the Visual editor. When I execute the code it says:

Parse error: syntax error, unexpected ‘&’ in /home/content/p3pnexwpnas09_data03/81/2766081/html/wp-content/plugins/insert-php/insert_php.php(48) : eval()’d code on line 9

[insert_php]
    if ( isset( $_POST['submit'] ) ) {
        global $wptd;
        $n1 = $_POST['n1'];
        $n2 = $_POST['n2'];
        $n3 = $_POST['n3'];
        $n4 = $_POST['n4'];
        $wpdb->query( prepare( 
            "INSERT INTO $wpdb->communitycauses (des,city,state,date)
                VALUES (%d,%s,%s)",
            array ( 
                $n1, 
                $n2, 
                $n3, 
                $n4 
            ) 
        ) ); 
    } else {
        echo "Enter the cause Please";
    }
[/insert_php]
  • 2
    Embedding PHP inside content is incredibly dangerous, you should avoid it at all costs. If you need to run custom code, use theme templates and shortcodes, and uninstall the plugin that gives you the insert_php shortcode immediatley. It's a massive security hole – Tom J Nowell Nov 8 '15 at 19:40
  • Thanks Tom , But someone recommended me the plugin and i also viewed its review "all good" .I am not aware of this plugin so much though but could you recommend me some other way as i just want to insert data from a wordpress page designed on visual composer to database.Thanks again – Gambhir Nov 8 '15 at 19:44
  • 3
    It's not so much the plugin itself, the plugin does what it does very well, but what it's doing is itself very insecure. Anything that takes input and evaluates it as PHP code at runtime is horrifically insecure. Anybody with DB access to your site, or the ability to edit or create posts has total control over your server via this shortcode – Tom J Nowell Nov 8 '15 at 19:49
  • As a sidenote, rather than having a custom table communitycauses, you should look into custom post types, that way you get a user interface and archives/URL/theme templates all for free – Tom J Nowell Nov 8 '15 at 19:50
  • 1
    Thanks Tom :) I I think its better to build a custom template Right! – Gambhir Nov 8 '15 at 19:54
1

Code is Code and content is content and they should not be mixed together. the editor is not a code editor, the content can and usually will be transformed in a way you don't expect which might result in your code failing with no obvious reason.

Just don't do it. Write your own shortcode that does what you need and use it.

  • 1
    Thank you Mark for the answer ,You are right Tom has also suggested me not to use this .Just going to use custom template – Gambhir Nov 8 '15 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.