Re: note 90897 deleted from function.eval by thiago

It's actually something I didn't know, and could be helpful. The thing is it's using eval and that could be bad if someone threw a $id = $_REQUEST['something'], as I'd expect someone new would do with this piece of code. I kinda missed the right link to click. The reason was supposed to be "bad code". Thiago Henrique Pojda http://nerdnaweb.blogspot.com On Fri, May 15, 2009 at 9:37 AM, Daniel Brown <danbrown@php.net> wrote: > What was the reason for deleting this one? I don't see anything > obviously wrong, but it could just be me. > > > > On Fri, May 15, 2009 at 07:58, <thiago@php.net> wrote: > > Note Submitter: chrisdone at gmail dot com > > > > ---- > > > > You can use it to embed arbitrary embeded languages or "macros": > > > > <?php > > $id = 10; > > > > // SQL > > ob_start(); ?> > > > > SELECT * FROM users WHERE parentid > $id > > AND name LIKE '%s%' > > > > <?php $f=ob_get_contents();ob_end_clean();$sql=eval('return ("' > .$f.'");'); > > > > echo $sql; > > > > ?> > > > > Outputs: > > > > SELECT * FROM users WHERE parentid > 10 AND name LIKE '%s%' > > > > -- > > PHP Notes Mailing List (http://www.php.net/) > > To unsubscribe, visit: http://www.php.net/unsub.php > > > > > > > > -- > </Daniel P. Brown> > daniel.brown@parasane.net || danbrown@php.net > http://www.parasane.net/ || � > �o�n�`��5���http://www.pilotpig.net/ > 50% Off All Shared Hosting Plans at PilotPig: Use Coupon DOW10000 > > -- > PHP Notes Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > >