Convert string to php action/function

Question

I'm using Yii framework. I want to make a php string into php action.

$var = 'echo "hello";';
//Something to do to run $var

I want to print $var how can I do that? There is a simple parse php from string option on Yii framework?

Do you really want to print $var or to echo 'hello'? The most dangerous function in PHP will do this, but it's the one that will allow abuse if you use it with user-generated strings — Mark Baker
– Mark Baker, Commented Aug 20, 2013 at 7:24
Take heed of any warnings when using eval(), you're almost certainly leaving your site open wide open to intentional or even accidental abuse. This is a back door for anyone to run malicious code, or to crash your server; and is rightly disabled by many ISPs — Mark Baker
– Mark Baker, Commented Aug 20, 2013 at 7:26
I'm trying to pass an function something like $expression[0] = 'Yii::app()->user->isAdmin()', eval return me only false and null without any thing related to the function. — Dar
– Dar, Commented Aug 20, 2013 at 7:34

Serj Zaharchenko · Accepted Answer · 2013-08-20 07:33:27Z

2

You may use eval() function. But, eval is evil in many cases and generally such way of coding makes code harder to follow and debug. Beware for potential unsafe input from user, because, if, for instance, you do

eval('echo "$var"')

and $var was set directly from $_POST, one may set $var='lol"; mail("[email protected]", "Some passwords", "/bin/cat /etc/passwd");' (provided, that webserver is under user that may have access to such functions and directories; even is not, it gives a plenty of opportunities to exploit such vulnerability). So, generally eval is bad idea, but sometimes it is the only solution. Anyway, be very careful.

answered Aug 20, 2013 at 7:33

Serj Zaharchenko

2,7311 gold badge19 silver badges21 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Samuel Liew · Accepted Answer · 2013-08-20 07:29:30Z

0

eval — Evaluate a string as PHP code

Evaluates the given code as PHP.

Caution The eval() language construct is very dangerous because it allows execution of arbitrary PHP code. Its use thus is discouraged. If you have carefully verified that there is no other option than to use this construct, pay special attention not to pass any user provided data into it without properly validating it beforehand.

http://php.net/manual/en/function.eval.php

answered Aug 20, 2013 at 7:29

Samuel Liew

79.5k112 gold badges173 silver badges318 bronze badges

Comments

Dar · Accepted Answer · 2013-08-20 07:44:17Z

0

$this->evaluateExpression($var);

answered Aug 20, 2013 at 7:44

Dar

4012 gold badges7 silver badges19 bronze badges

Collectives™ on Stack Overflow

Convert string to php action/function

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related