Parse variables in PHP string

Question

NOTE: Eval is used here in total knowledge, the string parsed is entered by an administrator only, and the purpose is to store instructions in database, without restrictions to the instructions. If you have a good alternative, it is always appreciated, but don't just say "eval is bad".

I have a String in PHP, for example

$myString = "(35*$var1*64)/$var2";

I want to eval() this string, but before, I want to modify all the variables in the string like this:

$var2 -> $_POST['var2']

There may or may not be a blank space after the variable in $myString .

When I eval $myString, PHP throws an error "Undefined variable $var1". PHP read the string and parse the variables, so I guess there should be a way to parse all the variables in the string.

The output should be:

$myStringParsed = "(35*$_POST['var1']*64)/$_POST['var2']";

or an equivalent.

Don't use " for string, as parser adds variables to string and it does not goes to eval tring. Also where is your eval code? — Justinas
– Justinas, Commented May 31, 2016 at 9:31
$myStringParsed = "(35*$_POST[$var1]*64)/$_POST[$var2]"; should be $myStringParsed = "(35*{$_POST[$var1]}*64)/{$_POST[$var2]}"; So, add the { } instances. — nl-x
– nl-x, Commented May 31, 2016 at 10:06

Igor R · Accepted Answer · 2016-05-31 10:36:50Z

1

Not maybe the best solution, but you can preprocess $_POST variable and generate $variablesString like this:

$variablesString = '';
foreach($_POST as $key => $val) {
    $variablesString .= '$' . $key . ' = ' . $val . ';' . PHP_EOL;
}

eval($variablesString . PHP_EOL . $myString)

For string support you can check if $val is string, and if yes - wrap it with quotes.

Second way

$myString = 'return (35 * $var1 * 64) / $var2;';
$re = "/\\$(\\w*)/im";

preg_match_all($re, $myString, $matches);

foreach($matches[1] as $match) {
    $search = '$' . $match;
    $replace = '$_POST[\'' . $match . '\']';
    $myString = str_replace($search, $replace, $myString);
}
echo eval($myString);

You can check it here

edited May 31, 2016 at 10:36

answered May 31, 2016 at 9:32

Igor R

4362 silver badges7 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

Pred Over a year ago

I can send anything in POST. like 0; unlink('/')

Igor R Over a year ago

Yes, you can. But Nathan noticed: Eval is used here in total knowledge, the string parsed is entered by an administrator only

Pred Over a year ago

It is still worth to notice it, since not only the OP will read this thread. You know we have space tech like search engines to find stuff on a mysterious network called internet.

Turtle Over a year ago

This solution is what I'm using right now. The problem is that I have to create the variables for EACH element in $_POST. Also, the question was focused on the parsing of the string. This solution works in my case, but there may be other cases where it isn't efficient. If no one provides a parsing solution, I'll accept this one.

Turtle Over a year ago

@IgorRynkovoy Yes, this is exactly what I want. It also works when the * touches the $var2. I don't know regex yet, will that work for *, +, -, / ? Tried on your example and it seemed to. Anyway, this is the solution. Thanks.

|

symcbean · Accepted Answer · 2016-05-31 09:45:44Z

0

Assuming you mean....

$myString = '(35*$var1*64)/$var2';

The a more robust solution (consider $myvar10) than that suggested by ASGM is:

$replace=array(
   '/\b\$var1\b/'=>$_POST['var1'], 
   '/\b\$var2\b/'=>$_POST['var2'],
   ...
);
$interpolated=preg_replace(array_keys($replace)
    , $replace, $myString);

Note that I would recommend that you interpolate the string with literals rather than substituting one place holder for another. In addition to eliminating unnecessary processing, it also means you can check the content of the resulting string to ensure it only contains digits and operators (and a restricted number of functions if appropriate).

answered May 31, 2016 at 9:45

symcbean

48.4k6 gold badges63 silver badges99 bronze badges

1 Comment

Turtle Over a year ago

It seems the question wasn't clear. I can't know beforehand if the name of the variables will be $var1 or $myVar or such. I want to parse the string for any expression that would be a variable.

Justinas · Accepted Answer · 2016-05-31 11:09:09Z

0

You are using wrong string enclosing quotes. Use '(35*$var1*64)/$var2':

//$var1 = $_POST['var1'];
//$var2 = $_POST['var2'];

$var1 = '10';
$var2 = '20';

$myString = 'return (35 * $var1 * 64) / $var2;';

echo eval($myString);
//1120

Working example of eval

If you want to take any variable from POST, than you can use extract() to get array keys as variables with associated values:

<?php
// Change it to real $_POST
$POST = [
    'var1' => '10',
    'var2' => '20',
];

extract($POST, EXTR_SKIP);

$myString = 'return (35 * $var1 * 64) / $var2;';

echo eval($myString);

edited May 31, 2016 at 11:09

answered May 31, 2016 at 9:38

Justinas

43.9k5 gold badges72 silver badges108 bronze badges

4 Comments

Turtle Over a year ago

Thanks for your answer. No, the variables $var1 and $var2 are NOT defined. I just pointed the fact that they are parsed by PHP. I want to replace these expressions.

Justinas Over a year ago

@Nathan You can't work with undefined variables. That's why I have commented how they should be defined using $_POST. Also if $var2 is not defined than $_POST[$var2] makes no sense.

Turtle Over a year ago

I'm sorry, you are right. My question was false. The fact is that $var2 is not defined but $_POST['var2'] is. I forgot to take out the $. Edited question.

Justinas Over a year ago

@Nathan Check updated answer on how to extract POST to variables.

Collectives™ on Stack Overflow

Parse variables in PHP string

3 Answers 3

Second way

7 Comments

1 Comment

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Second way

7 Comments

1 Comment

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related