Re: Re: Trying to avoid code exploits..

On Wednesday 01 August 2001 15:46, Phil Driscoll wrote: > > Is this staement safe ? > > > > eval('$a = $GLOBALS["pass1"]==$GLOBALS["pass2"]'); > > Maybe I'm missing the point, but why not just go: > $a = $GLOBALS["pass1"]==$GLOBALS["pass2"]; I'm writing a form class which can also validate the form and I want to define the rules for validating the forms, so when defining the form I can add $form->AddRule('{pass1}=={pass2}','The 2 passowrd must be equal'); And this rule will be expanded to $a = $GLOBALS["pass1"]==$GLOBALS["pass2"] and validated through eval. When I call the $form->validate(); The class iterates through the rules array and in case of unmet condition (!$a) will return the error string associate with the rule. This method gives a great flexibility, ans as a result I can define any rule as long as it is a valid php code. Hope you get the idea -- Kriheli Meir