note 86234 added to function.eval

Concerning:
udo dot schroeter at gmail dot com
26-May-2007 08:40
Safer Eval

You have to check for further dynamic function call possibilities. Consider the following examples:

<?php
// will call str_repeat even if not allowed
new SaferScript('$badfunc[]="str_repeat"; print($badfunc[0]("ha ", 100));');

// this way you can execute all imaginable code
new SaferScript(
  '$badfunc[0]="create_function";
   $badfunc[1]=$badfunc[0]("", "echo str_repeat(\'here we go! \', 5);");
   $badfunc[1]();'
);
?>
----
Server IP: 212.124.37.9
Probable Submitter: 92.225.196.167
----
Manual Page -- http://www.php.net/manual/en/function.eval.php
Edit        -- https://master.php.net/note/edit/86234
Del: integrated  -- https://master.php.net/note/delete/86234/integrated
Del: useless     -- https://master.php.net/note/delete/86234/useless
Del: bad code    -- https://master.php.net/note/delete/86234/bad+code
Del: spam        -- https://master.php.net/note/delete/86234/spam
Del: non-english -- https://master.php.net/note/delete/86234/non-english
Del: in docs     -- https://master.php.net/note/delete/86234/in+docs
Del: other reasons-- https://master.php.net/note/delete/86234
Reject      -- https://master.php.net/note/reject/86234
Search      -- https://master.php.net/manage/user-notes.php