Best practice: Zend View: Load content from database and render PHP-code included in content - zend-framework

Question

Let's say I load a value from a database which return something like:
<?php
//Zend_Controller_Action
public function indexAction()
{
$dbContent = "<p>Hello <?php echo $user?>!</p>";
$this->view->paragraph = $dbContent;
}
?>
How is it possible, that
<?php echo $user?>
will be rendered?
What precaution need to be taken (safety issuses, XXS)?
Thanks so much indeed!
== Edit: ==
Sorry, I obviously formulated my question misunderstandingly. What I actually ment:
I would like to avoid implementing a template engine like smarty.
In my project, there will be content that has PHP-Code within a string and that needs to be parsed.
Example:
<?php
//Zend_Controller_Action
public function indexAction()
{
$dbContent = "<p>Hello <?php echo $user?>!</p>";
$this->view->paragraph = $dbContent;
}
<?php
//viewscript.phtml
$user = 'John Doe';
echo $this->paragraph;
?>
is supposed to output:
Hello John Doe!
Is there any safe solution to do this without an external template engine?
Thanks once more... :-)

Answer 1

If found a solution here, which seems to perfectly fill my needs.
Thanks to all who answered here,
==UPDATE==
Unfortunately the posted link is dead. However, the solution was pretty simple. As far as i Remember, it went through the following steps:
Fetch content from database and save it in a file
Use Zend_Cache to check, whether this file exists
If file exists, simply render it. If not, go to step 1.
==UPDATE II ==
Found a copy of the page:
archive.org

Answer 2

In zend framework you will be always be able to print string (or whatever you want) from a controller but it's a very bad practice.
You should give the $user value from the controller to the view in this way:
$this->view->paragraph = $user;
and then, in the view, have:
<p>Hello <?php echo $this->paragraph; ?>!</p>
To ensure this code from XSS you should do some check before (before you print the value) like this:
$user = strip_tags($user);

Answer 3

Zend Framework doesn't support automatic output escaping , but you can prevent XSS in many ways.
First of all push all values into view layer and then print them with a View Helper like Zend\View\Escape , by default it returns string under htmlspecialchars() but you can set a callback function simple with :
//view.phtml
$this->setEscape('yourClass','methodName');
$this->setEscape('functionName');
echo $this->escape($this->myGreatDbValue);
Sure you can create your custom View Helper for all your need.
Another way is to create a custom View class extending Zend\View\Abstract , override __get() magic method and filtering output .
Read documentations for Zend View Helper and Zend Filter: http://framework.zend.com/manual/en/zend.filter.html
http://framework.zend.com/manual/en/zend.view.helpers.html