note 60953 added to function.eval

The eval function can be misused for Cross Site Scripting(XSS) as well. Les say we have this very trivial page that allows a user to enter a text and see it formated using different styles. If the site designer was lazy and used eval function to come up with somethig like this: <?php $mytxt = $_GET["text"]; $strFormats = array( '<h1>$mytxt</h1>', '<h2>$mytxt</h2>', '<span class="style1">$mytxt</span>'); //so on foreach ($strFormats as $style){ eval("echo $style;"); } ?> This page could be a target for XSS, because user input is not validated. So the hacker could enter any valid PHP commands and the site will execute it. Imagine what could happen if the injected script reads files like config.php and passed it to the hacker's site. If the file permissions are not set correctly, the injected script could modify the current script. A form's action parameter can be set to a hacker's site or worse every transaction could be secretly posted to another website from within the server. Injected script could be something like this: <?php $filename=basename($_SERVER['PHP_SELF']); $fp = fopen($filename, "a"); $str = echo "<!-- XSS Vulnerability-->"; // could be any PHP command fwrite($fp, $str); fclose($fp); ?> The golden rule is don't trust the user. Always validate data from the client side. ---- Server IP: 85.116.0.130 Probable Submitter: 83.151.234.19 ---- Manual Page -- http://www.php.net/manual/en/function.eval.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+60953 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+60953&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+60953&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+60953&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+60953&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+60953&report=yes&reason=non-english Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+60953&report=yes&reason=already+in+docs Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+60953&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+60953&report=yes Search -- http://master.php.net/manage/user-notes.php