note 86234 added to function.eval

Concerning: udo dot schroeter at gmail dot com 26-May-2007 08:40 Safer Eval You have to check for further dynamic function call possibilities. Consider the following examples: <?php // will call str_repeat even if not allowed new SaferScript('$badfunc[]="str_repeat"; print($badfunc[0]("ha ", 100));'); // this way you can execute all imaginable code new SaferScript( '$badfunc[0]="create_function"; $badfunc[1]=$badfunc[0]("", "echo str_repeat(\'here we go! \', 5);"); $badfunc[1]();' ); ?> ---- Server IP: 212.124.37.9 Probable Submitter: 92.225.196.167 ---- Manual Page -- http://www.php.net/manual/en/function.eval.php Edit -- https://master.php.net/note/edit/86234 Del: integrated -- https://master.php.net/note/delete/86234/integrated Del: useless -- https://master.php.net/note/delete/86234/useless Del: bad code -- https://master.php.net/note/delete/86234/bad+code Del: spam -- https://master.php.net/note/delete/86234/spam Del: non-english -- https://master.php.net/note/delete/86234/non-english Del: in docs -- https://master.php.net/note/delete/86234/in+docs Del: other reasons-- https://master.php.net/note/delete/86234 Reject -- https://master.php.net/note/reject/86234 Search -- https://master.php.net/manage/user-notes.php