Forum OpenACS Q&A: Response to Translation of vars within string
6: Response to Translation of vars within string (response to 1)
Posted by Michael A. Cleverly on 11/04/01 09:09 AM
And I want to avoid David's solution <%=$first_names%> because I want "mere users" to be able to enter a few variables in a text string that gets stored in the db and later select and substitute with the current value of, for instance $name. in the string to render on the page.... (clear?)If that's the case, make sure you read the man page for subst, specifically the -nocommands switch. Otherwise some malicious user could save as their string: "Goodbye $first_names $last_name. [exec rm -r -f /]. Have a nice day. [ns_shutdown]", which probably wouldn't be something you'd want.
And, just for kicks, say you only wanted certain variables to be substituted. (So that $first_name doesn't blow up.) You could use Tcl 8's very handy string map:
set html [string map [list $first_names $first_names $last_name $last_names $foo $foo] $user_string_from_database](I hope the backslashes above make it or the code will look positively stupid.