Eval in PHP and security measures , Creating a PHP demo editor

Question

I know that eval is the function in PHP to execute PHP code from an input. Now I want to make a W3Schools like editor. What can I do to protect eval code that I get from POST variable.

$code = eval($_POST["phpusercode"]);
echo $code;

What I want to do is when a user will make a function like this

I want to give user the ability to write his own PHP code on my site without making my website vulnerable to some sort of hacking.

You can ask the people of writecodeonline.com/php how they did it perhaps, this discussion would lead way too far considering all the involved security risks. — Blizz
– Blizz, Commented Jul 2, 2014 at 9:07

Community · Accepted Answer · 2017-05-23 10:28:35Z

4

eval evaluates code, so, as @sectus says in comments, execute the code

For example:

eval ("echo 'Hello user'"); //This will execute echo 'Hello user'

So, in your case i think you don't want to execute your user code, so please carify your question and update it.

IMPORTANT:

Use of eval is highly discouraged
NEVER EVER use eval with params by POST/GET without sanitize them

Useful links:

When eval is evil

Avoid SQL injection

edited May 23, 2017 at 10:28

CommunityBot

11 silver badge

answered Jul 2, 2014 at 9:10

Sal00m

2,9143 gold badges24 silver badges33 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Mehmet Ince Over a year ago

Just for quick reminder; POST and GET are not only user controlled variables. You should check out COOKIE and all other http header parameters.

Collectives™ on Stack Overflow

Eval in PHP and security measures , Creating a PHP demo editor

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related