在HTML页面中显示纯PHP代码

Question

And I'm talking (especially) forums here - [PHP]code here[/PHP] - style. Some forums escape double quotes or other "dangerous characters" and others don't.

What is the best method? What are you guys using? Can it be done without the fear of code injection?

Edit: Who said anything about reinventing the wheel?

Answer 1

When PHP echo or print text, it never executes it. That only happens with eval. This means that if you did this:

echo '<?php ... ?>';

it would carry through to the page output and not be parsed or executed.

This means that all you need to do is escape the usual characters (<, >, &, etc.) and you should generally be safe.