Re: Eval use in XML_RPC

Joshua Eichorn wrote:

From my quick audit I see no area where it actual needs to be used, and just from a security standpoint I don't think eval should be allowed in Any PEAR code.

This statement is a little bit over zealous, static eval usage for php5 clone compatibaility is safe since the string doesn't come from user input. There might also be cases like the proxy generation in SOAP's WSDL class that won't work any other way. But still any use of eval from untrusted input should be avoided whenever possible. -josh