note 78276 deleted from language.oop5.autoload by crell
| From: | crell@php.net | Date: | Mon, 04 Apr 2022 16:06:59 +0000 |
| Subject: | note 78276 deleted from language.oop5.autoload by crell | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-218017@lists.php.net to get a copy of this message | ||
Note Submitter: rojoca
----
Be careful when using eval (as always) in __autoload. The following:
<?php
echo 'Start->';
function __autoload($class) {
eval('class ' . $class . ' {};');
}
$class = 'Class1{}; echo "uh oh"; class Class2';
$obj = new $class;
echo 'end';
?>
outputs:
Start->uh oh
You can use preg_replace to clean up $class to prevent executing abitrary code but in this case you
won't be able to throw a catchable exception and your script will end with a fatal error.