Re: note 90897 deleted from function.eval by thiago

I agree with you, it's not evil() but when misused it can be. Well, I saw a very big hole to exploit and that's why I deleted it. Just re-added as you asked. Cheers Thiago Henrique Pojda http://nerdnaweb.blogspot.com On Fri, May 15, 2009 at 9:54 AM, Daniel Brown <danbrown@php.net> wrote: > It's *not* bad code. It's on the eval() page. Everyone gives > eval() such a bad rap, and while I don't have any particular need for > it, folks need to understand that eval() will just exploit holes in > poor and insecure code. The eval() function *itself* is not bad. If > it were, it would have been named evil(). ;-P > > Go ahead and pop this note back into place when you get a chance, > if you would. > > > On Fri, May 15, 2009 at 08:51, Thiago Pojda <thiago@php.net> wrote: > > It's actually something I didn't know, and could be helpful. The thing is > > it's using eval and that could be bad if someone threw a $id = > > $_REQUEST['something'], as I'd expect someone new would do with this > piece > > of code. > > > > I kinda missed the right link to click. The reason was supposed to be > "bad > > code". > > > > > > Thiago Henrique Pojda > > http://nerdnaweb.blogspot.com > > > > > > On Fri, May 15, 2009 at 9:37 AM, Daniel Brown <danbrown@php.net> wrote: > > > >> What was the reason for deleting this one? I don't see anything > >> obviously wrong, but it could just be me. > >> > >> > >> > >> On Fri, May 15, 2009 at 07:58, <thiago@php.net> wrote: > >> > Note Submitter: chrisdone at gmail dot com > >> > > >> > ---- > >> > > >> > You can use it to embed arbitrary embeded languages or "macros": > >> > > >> > <?php > >> > $id = 10; > >> > > >> > // SQL > >> > ob_start(); ?> > >> > > >> > SELECT * FROM users WHERE parentid > $id > >> > AND name LIKE '%s%' > >> > > >> > <?php $f=ob_get_contents();ob_end_clean();$sql=eval('return ("' > >> .$f.'");'); > >> > > >> > echo $sql; > >> > > >> > ?> > >> > > >> > Outputs: > >> > > >> > SELECT * FROM users WHERE parentid > 10 AND name LIKE '%s%' > >> > > >> > -- > >> > PHP Notes Mailing List (http://www.php.net/) > >> > To unsubscribe, visit: > >> > http://www.php.net/unsub.php > >> > > >> > > >> > >> > >> > >> -- > >> </Daniel P. Brown> > >> daniel.brown@parasane.net || danbrown@php.net > >> http://www.parasane.net/ || > >> http://www.pilotpig.net/ > >> 50% Off All Shared Hosting Plans at PilotPig: Use Coupon DOW10000 > >> > >> -- > >> PHP Notes Mailing List (http://www.php.net/) > >> To unsubscribe, visit: http://www.php.net/unsub.php > >> > >> > > > > > > -- > </Daniel P. Brown> > daniel.brown@parasane.net || danbrown@php.net > http://www.parasane.net/ || > http://www.pilotpig.net/ > 50% Off All Shared Hosting Plans at PilotPig: Use Coupon DOW10000 > > -- > PHP Notes Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > >