note 34000 added to function.eval

This is the most horrifying use of eval we've seen yet. While making an online calculator we found you can call eval() from within a block of eval() code. It seems secure but who knows... Have fun debugging! function evilEval ($expr){ // remove dangerous characters $pattern = "/[^0-9a-zA-Z\*\+\-\(\)\/\%\.\,]/"; $t=preg_replace($pattern,"",$expr); // like <>$_[]"; and {}! $funcs="sin|cos|tan|log|pow"; // Only allow these functions! $funcarray=explode("|",$funcs); if (!function_exists("f_$funcarray[0]")){// If we haven't already, foreach ($funcarray as $func){ // let's create some funky $f="function f_$func(\$x){ // f_function wrappers for them! \$arglist=func_get_args(); \$args=\"\"; foreach(\$arglist as \$arg) \$args.=\",\$arg\"; \$args=substr(\$args,1); // argh! eval within eval! return eval(\"return $func(\$args);\");}"; eval ($f);} } // Preceed anything that could be a function (2 or more letters) // with f_ so only our wrappers will work. Exponents are left alone. $f=preg_replace("/[a-zA-Z][a-zA-Z]+/","f_\${0}",$t); echo "$t = ".eval("return ".$f.";"); } evilEval ('21/3*pow(2,4)'); // outputs: 112 evilEval ('tan(sin(log(5))*5e4)'); // outputs: -2.6845824808572 // Test evil input: Curses! Foiled again! evilEval ('unlink($PHP_SELF)'); // error: undefined function f_unlink()... ---- Manual Page -- http://www.php.net/manual/en/function.eval.php Edit Note -- http://master.php.net/manage/user-notes.php?action=edit+34000 Delete Note -- http://master.php.net/manage/user-notes.php?action=delete+34000&report=yes Reject Note -- http://master.php.net/manage/user-notes.php?action=reject+34000&report=yes