WordPress 4.8.1 php getting commented

Question

As you may know, when using the <?php tag in a page, it automatically gets commented by WordPress. There are numerous famous plugins allowing to bypass this, such as "insert PHP", but they don't work on WordPress 4.8.1 (I tested a few deprecated ones).

Does anyone know a way to use the <?php tag correctly in WordPress 4.8.1 ?

Answer 1

As I mentioned in the comments, you should not and also can not use codes inside your content. Any code tags that you use will be escaped.

Instead, define a shortcode in your theme's functions.php file and use that inside your content. Let's create a simple shortcode together:

function create_shortcode( $atts ) {
    // Create a default value for the attributes
    $atts = shortcode_atts( 
        array(
            'parameter' => 'default value',
        ), 
        $atts, 
        'my-shortcode' 
    );

    // Add your functions here and return the value.
    // The value can be anything, including a full
    // HTML code or a form.
    return "value = {$atts['paremeter']}";
}
add_shortcode( 'my-shortcode', 'create_shortcode' );

Now, by using [my-shortcode parameter="sample"] in your content you can output value = sample. Replace the code inside the shortcode with whatever you desire, which in your case is a HTML form.

Answer 2

Using the <?php tag "correctly" - meaning the WordPress way - means you can't use it within post content.

Some options you have:

1. Use a shortcode instead. This will allow you to execute pre-written PHP within a post/page/CPT content editor. These allow parameters and can be pretty dynamic.

2. Use a custom template. In a child theme, you have several ways to set a template up, and the template itself will contain the PHP you want to execute.

   • You can name the file to be used automatically, such as page-slug.php - replace "slug" with your Page's actual slug, which is the last part of the permalink. If you have www.example.com/mypage set up as a Page, you would create a file called "page-mypage.php" and that would automatically apply to that page. For a Post, use "post-mypage.php" etc.

   • Or, you can create a Page Template and manually select it. For example, you could create "tpl-fancy.php" with comments at the top of the file that name it the Fancy Page template. Then, when you create your Page, your Editor will have a dropdown menu that allows you to choose the Fancy Page template from a list. In this way, you can use the same template for multiple pages, and depending on what you want to accomplish this may be more efficient than making a separate template for each individual Page.

3. Otherwise, you'll need to execute PHP in other parts of your template. For example if you have a widgetized sidebar, you can create a custom PHP widget and drag it into that area. If you need a custom menu, you can create that within the appropriate template file. It all depends on what particular type of PHP you want to execute.

If you are able to update your question with more specific details about the code you want to execute, the community may have some suggestions on accomplishing that without enabling direct PHP execution within the content editor, which carries security risks.

Answer 3

Although the plugin Exce-WP https://wordpress.org/plugins/wp-exec-php/ has not been updated for a while, it seems to work well with WP 4.8.1 on the several sites that I use it.

(Expect a 'downvote' or 'hold' on this question because the moderators don't like 'opinion' questions. )

Added

Now that I think on this, there are security issues that might be involved if you let anyone include PHP code in a post or page, even with the use of shortcodes. Consider if a nefarious user added PHP code with a SQL statement to 'drop table'. Or insert malicious code on your page.

It would be better to create a child theme and then a custom template that included your PHP code. That would be more secure.

In my case, the site I use the PHP code plugin referenced is under my complete control; I am the only author. So in my case, the security risk is minimized, but not completely gone.