开发者

Is there another way to call this function besides using php's eval?

开发者 https://www.devze.com 2023-04-08 16:01 出处:网络
So there\'s a php function in a database field. Here\'s what it looks like: \'$put_fname_fn = function($filename) {

So there's a php function in a database field. Here's what it looks like:

'$put_fname_fn = function($filename) {
    return $filename.'.Z';
};'

I'm executing it like this:

$code = fetchFromDatabase(); // Get the function string
eval($code);
$put_fname_fn('MYFILE.TX开发者_JAVA技巧T'); // Convert it to MYFILE.TXT.Z

Is there a more graceful way to call the user function? I try to avoid using eval but I don't another way to do this.


There is no other way to evaluate code in PHP. (You could write the code to a file and include it, but that's just a hidden eval.)

Still you should probably reconsider your application design. Evaluating code from the database is a VERY BIG SECURITY RISK: If your database is compromised (using a simple and common SQL injection attack) you at the same time give the attacker arbitrary PHP code execution.

0

精彩评论

暂无评论...
验证码 换一张
取 消