note 63841 deleted from function.eval by danbrown
| From: | danbrown@php.net | Date: | Sun, 17 May 2009 19:56:20 +0000 |
| Subject: | note 63841 deleted from function.eval by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-155297@lists.php.net to get a copy of this message | ||
Note Submitter: evildictaitor at hotmail dot com
----
Don't use eval to obfruscate code. Don't. No. stop. Never. Ever. It's so incredibly
easy to decode, it's not worth it.
<?php
$someAwfulObfrsucatedCode = "1209;nlu[qer;j12.n";
function someImpressiveDeobfruscationRoutine($string){
..somecode..
return $realCode;
}
eval(someImpressiveDeobfruscationRoutine($someAwfulObfruscatedCode));
?>
To decode, try replacing eval with echo, and voila, your code in-tact.
Examples of misguided attempts at securing code with eval include base64[en|de]code and
url[en|de]code, but regardless of your encoding/decoding skills and functions, replacing eval with
echo will get the code back in all functions of this sort.