Re: note 90897 deleted from function.eval by thiago

It's *not* bad code. It's on the eval() page. Everyone gives eval() such a bad rap, and while I don't have any particular need for it, folks need to understand that eval() will just exploit holes in poor and insecure code. The eval() function *itself* is not bad. If it were, it would have been named evil(). ;-P Go ahead and pop this note back into place when you get a chance, if you would. On Fri, May 15, 2009 at 08:51, Thiago Pojda <thiago@php.net> wrote: > It's actually something I didn't know, and could be helpful. The thing is > it's using eval and that could be bad if someone threw a $id = > $_REQUEST['something'], as I'd expect someone new would do with this piece > of code. > > I kinda missed the right link to click. The reason was supposed to be "bad > code". > > > Thiago Henrique Pojda > http://nerdnaweb.blogspot.com > > > On Fri, May 15, 2009 at 9:37 AM, Daniel Brown <danbrown@php.net> wrote: > >>    What was the reason for deleting this one?  I don't see anything >> obviously wrong, but it could just be me. >> >> >> >> On Fri, May 15, 2009 at 07:58,  <thiago@php.net> wrote: >> > Note Submitter: chrisdone at gmail dot com >> > >> > ---- >> > >> > You can use it to embed arbitrary embeded languages or "macros": >> > >> > <?php >> > $id = 10; >> > >> > // SQL >> > ob_start(); ?> >> > >> > SELECT * FROM users WHERE parentid > $id >> > AND name LIKE '%s%' >> > >> > <?php $f=ob_get_contents();ob_end_clean();$sql=eval('return ("' >> .$f.'");'); >> > >> > echo $sql; >> > >> > ?> >> > >> > Outputs: >> > >> > SELECT * FROM users WHERE parentid > 10 AND name LIKE '%s%' >> > >> > -- >> > PHP Notes Mailing List (http://www.php.net/) >> > To unsubscribe, visit: http://www.php.net/unsub.php >> > >> > >> >> >> >> -- >> </Daniel P. Brown> >> daniel.brown@parasane.net || danbrown@php.net >> http://www.parasane.net/ || >> http://www.pilotpig.net/ >> 50% Off All Shared Hosting Plans at PilotPig: Use Coupon DOW10000 >> >> -- >> PHP Notes Mailing List (http://www.php.net/) >> To unsubscribe, visit: http://www.php.net/unsub.php >> >> > -- </Daniel P. Brown> daniel.brown@parasane.net || danbrown@php.net http://www.parasane.net/ || http://www.pilotpig.net/ 50% Off All Shared Hosting Plans at PilotPig: Use Coupon DOW10000