note 102729 added to function.php-check-syntax

nicolas dot grekas+php at gmail dot com has a great idea using an if block as a sandbox with eval for syntax checking. But it's important to note that if/when someone does break the if block code WILL be executed. That's why it's better to add "return TRUE;" to the very top. 

(Nicolas used token_get_all to balance braces. But from a security standpoint it's better not to leave out any possibility.)

What the if block does is makes function/class blocks conditional, which means they are not defined in the current scope.

What you should do is combine both techniques:

<?php

var_dump(eval("return TRUE; if(TRUE): ".$code." endif;"));

?>

If you use the alternative control structure syntax you don't even have to track braces (just look for another "endif;"). The alternative syntax isn't commonly used.

If someone does break the if block or any additional checking is bypassed the execution gets stopped at the return.

I use this technique to make sure an expression is valid for my template system. It's important to note that I don't use this alone: I use token_get_all to construct the template syntax (which isn't completely PHP's syntax). Using token_get_all I ensure that variable functions are forbidden, and only allowed functions can be used. I use the eval sandbox to simply ensure tokens are in a logical order.
----
Server IP: 64.71.164.2
Probable Submitter: 24.10.24.19
----
Manual Page -- http://www.php.net/manual/en/function.php-check-syntax.php
Edit        -- https://master.php.net/note/edit/102729
Del: integrated  -- https://master.php.net/note/delete/102729/integrated
Del: useless     -- https://master.php.net/note/delete/102729/useless
Del: bad code    -- https://master.php.net/note/delete/102729/bad+code
Del: spam        -- https://master.php.net/note/delete/102729/spam
Del: non-english -- https://master.php.net/note/delete/102729/non-english
Del: in docs     -- https://master.php.net/note/delete/102729/in+docs
Del: other reasons-- https://master.php.net/note/delete/102729
Reject      -- https://master.php.net/note/reject/102729
Search      -- https://master.php.net/manage/user-notes.php