note 108821 added to function.eval

Below was given a way to prevent eval'd code for interfering with global variables. Otherwise fine idea, which sadly does not work with malicious code. Global variables can be reached from inside of function easily, with or without eval, thus not making eval a way to prevent access to global variables: <?php function localeval($code) { eval($code); } $a = "a"; echo '$a before eval code: ' . $a . "\n"; // prints "a" localeval('$a = \'b\';'); echo '$a after localeval: ' . $a . "\n"; // still prints "a" eval('$a = \'b\';'); echo '$a after eval: ' . $a . "\n"; // prints "b" localeval('$GLOBALS["a"] = "c";'); echo '$a after another localeval: ' . $a . "\n"; // will print "c" localeval('global $a;$a = "2097";'); echo '$a after third localeval: ' . $a . "\n"; // will print "2097" ?> I personally find it slightly frustrating that PHP cannot be used for code that allows plugins, unless the code is extremely well designed. ---- Server IP: 80.81.171.181 Probable Submitter: 80.223.152.64 ---- Manual Page -- http://www.php.net/manual/en/function.eval.php Edit -- https://master.php.net/note/edit/108821 Del: integrated -- https://master.php.net/note/delete/108821/integrated Del: useless -- https://master.php.net/note/delete/108821/useless Del: bad code -- https://master.php.net/note/delete/108821/bad+code Del: spam -- https://master.php.net/note/delete/108821/spam Del: non-english -- https://master.php.net/note/delete/108821/non-english Del: in docs -- https://master.php.net/note/delete/108821/in+docs Del: other reasons-- https://master.php.net/note/delete/108821 Reject -- https://master.php.net/note/reject/108821 Search -- https://master.php.net/manage/user-notes.php