note 86234 deleted from function.eval by danbrown
| From: | danbrown@php.net | Date: | Sun, 17 May 2009 19:51:38 +0000 |
| Subject: | note 86234 deleted from function.eval by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-155281@lists.php.net to get a copy of this message | ||
Note Submitter: sumeruter+php add an at gmail dot com
----
Concerning:
udo dot schroeter at gmail dot com
26-May-2007 08:40
Safer Eval
You have to check for further dynamic function call possibilities. Consider the following examples:
<?php
// will call str_repeat even if not allowed
new SaferScript('$badfunc[]="str_repeat"; print($badfunc[0]("ha ",
100));');
// this way you can execute all imaginable code
new SaferScript(
'$badfunc[0]="create_function";
$badfunc[1]=$badfunc[0]("", "echo str_repeat(\'here we go! \',
5);");
$badfunc[1]();'
);
?>