How to execute a string as PHP?

[eurosale]

Hi,

a string is containing a codesnippet e.g:

$code="phpinfo();";

How can I call $code so that it is executed?

[keso]

From php manual:

---
eval -- Evaluate a string as PHP code
Description
mixed eval ( string code_str)


eval() evaluates the string given in code_str as PHP code. Among other things, this can be useful for storing code in a database text field for later execution.
---

so eval("phpinfo();") should work.

[eurosale]

Thanks for your help !!!! :D :p :D

[Chen]

Be extra careful with eval()! You do not want anyone to access variables you evaluate, it will allow him to do pretty much anything he wants.

[Dan615]

And make sure to escape the variable names if you're meaning for them to actually be modified:


// incorrect
$text = "This is text.";
eval("$text .= \"This is some more text.\";");


// correct
$text = "This is text.";
eval("\$text .= \" This is some more text.\";");


I had some major annoyances with that when working with templates and stuff :)

[Chen]

Originally posted by Dan615
And make sure to escape the variable names if you're meaning for them to actually be modified:

I had some major annoyances with that when working with templates and stuff :)
Or just use single quotes: :)
$text = "This is text.";
eval('$text .= " This is some more text.";');

[Dan615]

Originally posted by FireFly

Or just use single quotes: :)
$text = "This is text.";
eval('$text .= " This is some more text.";');

That doesn't work for variable names does it? Heh, always learning something new :p

[Chen]

Originally posted by Dan615
That doesn't work for variable names does it? Heh, always learning something new :p
What do you mean? It doesn't parse variables or special characters (\n, \t, etc.) inside single quotes.

The docs:
http://php.fastmirror.com/manual/en/language.types.string.php#language.types.string.sy ntax.single