PHP eval Function Usage Summary

This function I think a lot of friends know that the hacker used most of the sentence, can parse PHP code and run, eval is the function can not be banned in PHP, previously I thought I could ban this function in php.ini, the result failed.

Definition and usage

The eval () function calculates the string in PHP code, which must be a valid PHP code and must end with a semicolon, returns NULL if no return statement is called in the code string, or False if there is a parsing error in the code.

Syntax: eval (phpcode)

Parameter description

Phpcode required, specify the PHP code to be computed.

Hints and Notes

Note: The return statement terminates the calculation of the string immediately.

Note: This function is useful for code storage that is made available for future calculations in a database text field.

The PHP instance code is as follows:

<?php

$string = "Beautiful";

$time = "Winter";

$str = ' This is a $string $time morning! ';

echo $str. "<br/>";

Eval ("$str =" $str ";");

Echo $str;

?>

Output:

This is a $string $time morning!

This is a beautiful winter morning!

The eval () function is also useful in the CodeIgniter framework, where a class ci_db is defined dynamically in the/system/database/db.php file, based on the configuration of the system, with the following code snippet:

if (! isset ($active _record) OR $active _record = = TRUE)

{

Require_once (basepath. ' database/db_active_rec.php ');

if (! class_exists (' ci_db '))

{

Eval (' class ci_db extends Ci_db_active_record {} ');

}

}

Else

{

if (! class_exists (' ci_db '))

{

Eval (' class ci_db extends Ci_db_driver {} ');

}

}

Require_once (basepath. ' database/drivers/'. $params [' Dbdriver ']. ' /'. $params [' Dbdriver ']. ' _driver.php ');

Instantiate the DB adapter,phpfensi.com

$driver = ' ci_db_ '. $params [' Dbdriver ']. ' _driver ';

$DB = new $driver ($params);

This function can be used to substitute the value of the variable in the string, usually in the data processing database, the parameter code_str is the string to be processed, it is worth noting that the string to be processed to conform to the PHP string format, and at the end of the semicolon, the use of the string after the function will continue to the end of the PHP program .

