Code execution with eval()
Why it matters
eval() runs whatever PHP it receives. If any part of that string comes from a request, an attacker can run their own code on your server.
$result = eval('return ' . $_POST['formula'] . ';');// Allow only known operations
$ops = [
'add' => fn($a, $b) => $a + $b,
'sub' => fn($a, $b) => $a - $b,
];
$op = $ops[$_POST['op'] ?? ''] ?? null;
$result = $op ? $op((float)$_POST['a'], (float)$_POST['b']) : null;How to fix
Never run strings as code. Replace eval with explicit logic, a lookup table or a safe parser.
Scan my code
Scan my code β
Paste a file and PHP Safe points to every line that matches this rule.