PHP中的Eval和安全措施，创建PHP演示编辑器

Question

I know that eval is the function in PHP to execute PHP code from an input. Now I want to make a W3Schools like editor. What can I do to protect eval code that I get from POST variable.

$code = eval($_POST["phpusercode"]);
echo $code;

What I want to do is when a user will make a function like this

I want to give user the ability to write his own PHP code on my site without making my website vulnerable to some sort of hacking.

Answer 1

eval evaluates code, so, as @sectus says in comments, execute the code

For example:

eval ("echo 'Hello user'"); //This will execute echo 'Hello user'

So, in your case i think you don't want to execute your user code, so please carify your question and update it.

IMPORTANT:

• Use of eval is highly discouraged
• NEVER EVER use eval with params by POST/GET without sanitize them

Useful links:

When eval is evil

Avoid SQL injection