Use of eval can be insecure

문서 > Datadog 보안 > Code Security > Static Code Analysis (SAST) > SAST 규칙 > Use of eval can be insecure

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

ID: php-security/no-eval

Language: PHP

Severity: Error

Category: Security

CVE: 2017-9807

Description

Do not use the eval() function in PHP. The eval() function evaluates a string as PHP code, which can lead to serious security risks if the string contains user input or data from an untrusted source. This is because it opens the door to code injection attacks, where an attacker can execute arbitrary PHP code.

To adhere to this rule and avoid potential security vulnerabilities, you should never use eval() in your PHP code. Instead, consider using safer alternatives that don’t evaluate strings as code. For instance, if you want to dynamically call a function based on a string name, you can use the call_user_func() function. Always ensure to sanitize and validate any user input or data from untrusted sources.

Non-Compliant Code Examples

<?php
$code = "echo 'test'";
eval($code);

Compliant Code Examples

<?php
echo 'test';