note 50421 added to function.eval

An obvious security reminder, which I think wasn't yet mentioned here. Special care is required when variables entered by the user are passed to the eval() function. You should validate those user inputs, and really make sure they have the format you expect. E.g., if you evaluate math expressions with something like <?php eval("\$result = $equation;"); ?> without any check on the $equation variable, a bad user could enter in the $equation field ""; echo file_get_contents('/etc/passwd') - or whatever PHP code he wants! - which would evaluate to <?php $result = ""; echo file_get_contents('/etc/passwd'); ?> and seriously compromising your security! ---- Manual Page -- http://www.php.net/manual/en/function.eval.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+50421 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+50421&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+50421&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+50421&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+50421&report=yes&reason=useless Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+50421&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+50421&report=yes Search -- http://master.php.net/manage/user-notes.php