Use of eval can be insecure

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Metadata

ID: php-security/no-eval

Language: PHP

Severity: Error

Category: Security

CVE: 2017-9807

Description

Do not use the eval() function in PHP. The eval() function evaluates a string as PHP code, which can lead to serious security risks if the string contains user input or data from an untrusted source. This is because it opens the door to code injection attacks, where an attacker can execute arbitrary PHP code.

To adhere to this rule and avoid potential security vulnerabilities, you should never use eval() in your PHP code. Instead, consider using safer alternatives that don’t evaluate strings as code. For instance, if you want to dynamically call a function based on a string name, you can use the call_user_func() function. Always ensure to sanitize and validate any user input or data from untrusted sources.

Non-Compliant Code Examples

<?php
$code = "echo 'test'";
eval($code);

Compliant Code Examples

<?php
echo 'test';
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains

Seamless integrations. Try Datadog Code Analysis