php - convert single quoted string to double quoted

Question

Been searching here and google for over an hour, can't seem to find the answer to this.

I have a string returned from a database query which contains variables, however it appears that these strings are all returned single-quoted and therefore the variables are not evaluated as they would be if it was double quoted.

what is returned from the sql query would be the $result:

This will not evaluate the 2 variables:

$myname = 'david';
$occupation = 'Beginner';
$result = 'Hello my name is $myname and I my occupation is $occupation';
echo $result;

This will evaluate the 2 variables:

$myname = 'david';
$occupation = 'Beginner';
$result = "Hello my name is $myname and I my occupation is $occupation";
echo $result;

My question is how do I convert a single-quoted string to a double-quoted string which is able to evaluate the variables ??

Thanks

Divers

Answer 1

PHP does not have a standard safe way to do this, right now. There has been an open feature request for years asking for it: http://bugs.php.net/bug.php?id=43901

One of the comments on the ticket offers a regex to do simple $foo and ${foo} substitution:

function stringExpand($subject, array $vars) {
  foreach ($vars as $name => $value) {
    $subject = preg_replace(sprintf('/\$\{?%s\}?/', $name), $value, $subject);
  }
  return $subject;
}

Gilead

Looks like that issue has been marked Wont fix in 2015 – Polyhistor

Answer 2

If you know the names of the variables you want to replace you can do this...

$myname = 'david';
$occupation = 'Beginner';
$result = 'Hello my name is $myname and I my occupation is $occupation';

$result = str_replace( 
              array('$myname', '$occupation'),  
              array($myname, $occupation),
              $result );

Which will be quicker than Nathan's stringExpand function, but if you don't know the variable names, then do use Nathan's method.

The problem I was trying to solve when I found this question was to do with linebreaks in a csv feed and was solved something like this:

// string from drupals csv feed tamper settings
$string = '22 Acacia Avenue\n Irlam\n Manchester'; 
$string = str_replace('\n', "\n", $string);
print nl2br($string); // demonstrates that the \n's are now linebreak characters

Hives

Answer 3

You could do something like this:

<?php
$myname = 'david';
$occupation = 'Beginner';
eval("\$result = 'Hello my name is $myname and I my occupation is $occupation';");
echo $result;
?>

However, I strongly DO NOT recommended evaluating any code from a database. Anything out of your control is a security risk.

Furcula

Ugh, don't use eval, especially for strings coming from a database. Unless you have strict control or perfectly sanitize the strings, this can be a horrible security hole. – Gilead

Exactly as I said below the code snippet ;) A replacement method would be better suited, as you posted, but I answered the question literally. Have an upvote – Furcula

Haha, my bad. I saw the eval and my vision just went blurry. :D – Gilead

Answer 4

I had this with line endings and came up with this function thats uses php's native str_replace

  /**
   * Converts delimiters to enable escape sequences.
   *
   * @param string $delimiter
   * 
   * @return string 
   */
  public function delimiterEscapeSequence(string $delimiter) {
    $order   = array('\r\n', '\n', '\r');
    $replace   = array("\r\n", "\n", "\r");

    // Processes \r\n's first so they aren't converted twice.
    $double_quoted = str_replace($order, $replace, $delimiter);

    return $double_quoted;
  }

Polyhistor