Section B.1. eval( )

B.1. eval( )

The eval( ) function is used for evaluating a string as PHP. For example:

     <?php     $name = 'Chris';     $string = 'echo "Hello, $name";';     eval($string);     ?> 

This executes $string as if it were PHP, so this is equivalent to the following:

     <?php     $name = 'Chris';     echo "Hello, $name";     ?> 

While useful, eval( ) is very dangerous when tainted data is used. For example, if $name is tainted, an attacker can execute arbitrary PHP code:

     <?php     $name = $_GET['name'];     eval($name);     ?> 

I recommend that you avoid using eval( ) when possible and when you cannot ensure that you never use tainted data in the construction of a string to be interpreted as PHP. This function is a good candidate for inspection during a security audit or peer review.