note 50421 deleted from function.eval by googleguy

Note Submitter: francois at bonzon dot com ---- An obvious security reminder, which I think wasn't yet mentioned here. Special care is required when variables entered by the user are passed to the eval() function. You should validate those user inputs, and really make sure they have the format you expect. E.g., if you evaluate math expressions with something like <?php eval("\$result = $equation;"); ?> without any check on the $equation variable, a bad user could enter in the $equation field ""; echo file_get_contents('/etc/passwd') - or whatever PHP code he wants! - which would evaluate to <?php $result = ""; echo file_get_contents('/etc/passwd'); ?> and seriously compromising your security!