2 March 2005

Wordpress PHP Exec Plugin

Posted under: at 11:19

This plugin lets you execute dynamic PHP code in posts. It masks PHP code before balanceTags, and unmask them afterwards, so it should be safe to use PHP code that has literal HTML tags in it, for example: code which print out HTML.

Requirement

WordPress 1.5. Version 1.2 is not supported. You will also need PHP version 4.3.0 or later.

Do NOT use this plugin if you can’t trust people who make posts in your WordPress installation, it is a HUGE security hole. User level is now supported! By default the plugin only operates on level 9 user.

Installation

  1. Download the plugin: phpexec.txt
  2. Rename the plugin to phpexec.php and put it into your wp-content/plugins directory
  3. Activate the plugin from WordPress administration menu

Usage

In posts, enclose any PHP code you want to execute with <phpcode> … </phpcode>. Only real PHP code allowed, no <?php … ?> blocks allowed. The block will then be replaced by the output of PHP code. In <phpcode> blocks, you will need to start any PHP command with <?php and end it with ?> as usual.

From the Wordpress admin menu, you can change minimum user level that is allowed to use the plugin. It is available from Options - PHPExec menu.

Example

<phpcode>
<?php
echo "Current date and time: ";
echo date("l dS of F Y h:i:s A");
?>
</phpcode>

Demonstration

Output of the above code:

Current date and time: Monday 12th of May 2008 05:59:59 AM

Credits

This plugin is inspired by RunPHP, another plugin which accomplishes the same thing but did not work for me. Thanks to iang for tricks to make embedded PHP code feels more like a real PHP code. Some code are borrowed from WordPress source code. Thanks to Beau Collins for the user level code.

Changelog

1.0:

  • First public release

1.1:

  • Non backward compatible change: now you need to enclose PHP code with <?php … ?> as you would do in real PHP script.

1.2:

  • Added filters to handle excerpts.

1.3:

  • Fixed a small error in evaled code, thanks to AJ for spotting this.

1.4:

  • Added user level security feature.

1.6:

  • Try to avoid using common variable names (thanks to David H. Brown)

1.7:

  • Removing debugging comments should fix the problem with automatic tag insertion done by Wordpress.

370 Responses

Trackback: Use this URI to trackback this entry. Use your web browser's function to copy it to your blog posting.

Comment RSS: You can track conversation in this page by using this page's Comments RSS (XML)

Gravatar: You can have a picture next to each of your comments by getting a Gravatar.

Karma Threshold: none -3 -2 -1 0 +1 +2 +3