note 102729 deleted from function.php-check-syntax by danbrown

Note Submitter: luke at cywh dot com ---- nicolas dot grekas+php at gmail dot com has a great idea using an if block as a sandbox with eval for syntax checking. But it's important to note that if/when someone does break the if block code WILL be executed. That's why it's better to add "return TRUE;" to the very top. (Nicolas used token_get_all to balance braces. But from a security standpoint it's better not to leave out any possibility.) What the if block does is makes function/class blocks conditional, which means they are not defined in the current scope. What you should do is combine both techniques: <?php var_dump(eval("return TRUE; if(TRUE): ".$code." endif;")); ?> If you use the alternative control structure syntax you don't even have to track braces (just look for another "endif;"). The alternative syntax isn't commonly used. If someone does break the if block or any additional checking is bypassed the execution gets stopped at the return. I use this technique to make sure an expression is valid for my template system. It's important to note that I don't use this alone: I use token_get_all to construct the template syntax (which isn't completely PHP's syntax). Using token_get_all I ensure that variable functions are forbidden, and only allowed functions can be used. I use the eval sandbox to simply ensure tokens are in a logical order.