note 59862 added to function.eval

eval() is used to protect (read: hide) source code. A well known way to encrypt some php code is security through obscurity. Someone used eval(base64_encode(".....")); - which basically had 10-16 nested calls to eval(base64_encode()) inside the data. E.g. <? eval(gzinflate(base64_decode('AjHRawIHG1ypUpudV.....'))); ?> However this can be decoded in this way: <? echo "\nDECODE nested eval(gzinflate()) by DEBO Jurgen <jurgen@person.be>\n\n"; echo "1. Reading coded.txt\n"; $fp1 = fopen ("coded.txt", "r"); $contents = fread ($fp1, filesize ("coded.txt")); fclose($fp1); echo "2. Decoding\n"; while (preg_match("/eval\(gzinflate/",$contents)) { $contents=preg_replace("/<\?|\?>/", "", $contents); eval(preg_replace("/eval/", "\$contents=", $contents)); } echo "3. Writing decoded.txt\n"; $fp2 = fopen("decoded.txt","w"); fwrite($fp2, trim($contents)); fclose($fp2); ?> ---- Manual Page -- http://www.php.net/manual/en/function.eval.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+59862 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+59862&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+59862&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+59862&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+59862&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+59862&report=yes&reason=non-english Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+59862&report=yes&reason=already+in+docs Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+59862&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+59862&report=yes Search -- http://master.php.net/manage/user-notes.php