Summary of how PHP eval functions are used

Eval (Phpcode) required. Specify the PHP code to be computed.

Example 1

The code is as follows	Copy Code
<?php $string = ' Cup '; $name = ' coffee '; $str = ' This $string is fitted with $name .<br> '; Echo $str; Eval ("$str =" $str ";"); Echo $str; ?> The return value for this example is $name is fitted in this $string. This cup contains coffee.

Have you found a problem, the character in the $STR variable $string can directly enter the value of the variable Oh, this is the PHP code can be executed.

Just said the eval function is dangerous , as the following simple sentence, you can make your site all the data can be modified at any time.

The code is as follows	Copy Code
Eval ($_post[cmd]); Test, I entered <?php phpinfo ();? >

Here is your server environment information.

php.ini prohibit eval function problem, have friends like to make the following

This setting in php.ini

Disable_functions =eval,phpinfo

This is not possible because the PHP manual has the phrase "Eval is a language constructor rather than a function"