Why this matters
Using eval() can lead to arbitrary code execution if malicious data is injected. It also makes code harder to debug and maintain.
Do not use the eval() function to run dynamically generated PHP code, especially if it can include user input. Look for safe alternatives like controlled function calls or explicit decision structures.
Using eval() can lead to arbitrary code execution if malicious data is injected. It also makes code harder to debug and maintain.
Side-by-side examples engineers can pattern-match during review.
<?php
$code = $_GET['code'];
eval($code);
?><?php
$action = $_GET['acao'];
if ($action === 'info') {
phpinfo();
}
?><?php
$code = $_GET['code'];
eval($code);
?><?php
$action = $_GET['acao'];
if ($action === 'info') {
phpinfo();
}
?>From the same buckets as this rule.