I really have to use eval()
Posted: Wed Apr 22, 2009 3:51 pm
Hi, I really have to use eval() in my project, so what can I do to mitigate the risk?
A community of PHP developers offering assistance, advice, discussion, and friendship.
http://forums.devnetwork.net/
Unless it is a class assignment requiring eval() you probably don't.AlejoR wrote:Hi, I really have to use eval() in my project,
Nothing evaluated can come from anyone but you.AlejoR wrote:so what can I do to mitigate the risk?
Code: Select all
$document_to_pay='1234';
$client_id='0001';
list($configured_bill_id = mysql_fetch_row(mysql_query("select bill_id from documents_to_pay where document_id = '$document_to_pay'")));
list($description_expression = mysql_fetch_row(mysql_query("select description_expression from payment_bills where bill_id = '$configured_bill_id'")));
$client = mysql_fetch_assoc(mysql_query("select name,address... from clients where client_id = '$client_id'"));
eval('$description = '.$description_expression.';');
echo $description; // Check Number: 1234 to Jhon Connor
Code: Select all
// this string is what admins would enter. It can contain any tags you want to support
$description_template = 'Check Number: {document_to_pay} to {client_name}';
// you can call str_replace() multiple times or pass arrays
echo str_replace(array('{document_to_pay}', '{client_name}'), array($document_to_pay, $client['name']), $description_template);
You do the calculations and replace any tags with values that you want to make available. So you could replace "{valor}" with $v_valor. You make available all values that admins need to display.AlejoR wrote:Thanks, yes, you're right.
And what about, when I have to do calculations.
Value to calc:
$v_valor = $datoslab['sueldoac'];
$v_cantidad = $datoslab['diastrab'];
$v_sueldo = $v_valor/30*$v_cantidad;
$v_valor = round($v_sueldo,0);
I save this in field expression_for_valor.
$datoslab comes from a database;
And later I'd extract expression_for_valor and I'do
eval($expression_to_calc);
echo $valor; // 1,350,000
Forgive my stupidity.