note 104268 deleted from function.eval by danbrown
| From: | danbrown@php.net | Date: | Sat, 04 Jun 2011 22:35:40 +0000 |
| Subject: | note 104268 deleted from function.eval by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-180263@lists.php.net to get a copy of this message | ||
Note Submitter: webmaster at bestcode dot com
----
When you want the user provide a formula to interpret, eval function is dangerous to use. A
malicious user can type PHP code that may do harm when executed. To overcome this security problem
with eval, it is sometimes better to parse a simple mathematical expression using PHP without
relying on eval function.
To achieve this there is a Math Parser for PHP here:
http://www.bestcode.com/html/math_parser_for_php.html
bcParserPHP can parse and evaluate expressions given at runtime without using eval() PHP function
for security reasons. You can have user defined functions, variables in the expressions. It supports
string literals and some boolean logic in the expression as well.
Here is sample code:
$parser = new MathParser();
$parser->setExpression($expr);
$parser->setVariable('X', 5);
echo 'Result=' . $parser->getValue();
Mete