eval() and PHP errors

Question

I have a eval function like this

if(FALSE === @eval($code)) echo 'your code has php errors';

So if the code has synthax errors it will return that message.

The problem is that if within the code you have something like:

  require_once('missing_file.php');

it will just break the page, without my nice error message :(

Is there any workaround for this?

Also, please don't put false on the left hand side of the ===. It makes me queasy... — Stephen
– Stephen, Commented Jul 30, 2010 at 21:01
but i have very justified reason to use eval(). I want the site admin to have the ability to add his own php code, instead of editing the application files (and loosing his changes when he updates the app). — Alex
– Alex, Commented Jul 30, 2010 at 21:04
@Alex Some kind of pluggable architecture would be infinitely better than having them store PHP code in a string somewhere and evaling it — Michael Mrozek
– Michael Mrozek, Commented Jul 30, 2010 at 21:11
this is based on wordpress, which is already pluggable. but some users might want a simple web interface for this, like a textarea with codemirror on it. — Alex
– Alex, Commented Jul 30, 2010 at 21:14
@Alex - and what happens when your user gives away a password or leaves it somewhere? Or they use 'password' and someone guesses it? Your server will be rooted. Don't eval unchecked code from the web. It's a very very bad idea. — Cfreak
– Cfreak, Commented Jul 30, 2010 at 21:18

Artefacto · Accepted Answer · 2010-07-30 21:04:41Z

2

Well, first I hope that $code comes from a trusted source and that you're executing arbitrary code sent by the users.

Second, the only way I see you can workaround that is to save $code into a file, run it with the command line PHP interpreter, and check the exit value. Note that passing this test doesn't make $code fatal error free, it just so happened that this particular execution of the script did not throw any fatal error; there may be other code paths that trigger such an error.

This is because once eval triggers a fatal error, it can't be recovered and the script dies. eval only returns FALSE if there is a parsing error.

answered Jul 30, 2010 at 21:04

Artefacto

98.1k17 gold badges207 silver badges232 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Alex Over a year ago

only file including functions like 'require' cause fatal errors?

Artefacto Over a year ago

@Alex No, there are many conditions that trigger fatal error.

Stephen Over a year ago

Not knowing PHP too well - could you try/catch the eval, or does that not work?

Collectives™ on Stack Overflow

eval() and PHP errors

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related