[RESOLVED] secure use of eval

[pasokonkun]

Basically I want to do this:

$var=$array['key1']['key2']['key3'][...];

My problem:
The information about the keys is stored in a string.

for example:

$arraypathstring="['articles']['title']";

The only solution I found to solve this problem was to assemble a string first and then use the eval function.

eval('$var=$array'.$arraypathstring.';');

This works, but as there are some security issues with the eval function, I would like to know...

... If there is another way of achieving the same result

... or what I can do to reduce security risks, when using the eval function

[toplay]

Maybe you can use variable variables:

http://us3.php.net/manual/en/language.variables.variable.php

It's a security risk either way if you're not validating and filtering the contents.

[pasokonkun]

Thank you for your proposal. I did not think of that!!!

Anyway, my major concern is the security issue. So what is the best way to validate and filter the string before applying such operations?

[toplay]

Well, you didn't really specify what the contents of the data is. But you can use preg_replace() and/or str_replace() to search and strip unwanted data. If you don't allow any PHP or HTML tags, then use strip_tags(). Read up on security stuff (links in my signature line).

[pasokonkun]

Thank you for your hints! The Links about security were very helpful.

I tried to rewrite my code that I just need to use variable variables instead of eval.

But this does not seem to work:
I tried many variations, but I did not succeed
this one seemed to be the most reasonable, but it also did not work:

$arraypathstring='[articles][title]';
$array[articles][title]='SAMPLEDATA';
$createdstring='array'.$arraypathstring;
$var= ${$createdstring};
echo "<br>VARIABLE CONTENT is EMPTY:".$var;

[toplay]

Like this:

$ary_name = 'array';
$x = 'articles';
$y = 'title';

${$ary_name}[$x][$y]='SAMPLEDATA';

$var= ${$ary_name}[$x][$y];

echo '<br>VARIABLE CONTENT is: ', $var;

hth.

[pasokonkun]

Thank you for your code!

Tested a little bit aroud with it and realized that for my purpose this would be sufficient:

 $x = 'articles';
 $y = 'title';
 $array['articles']['title']='SAMPLEDATA';
 $var= $array[$x][$y];

 echo '<br>VARIABLE CONTENT is: ', $var;

However there is a problem with this code:
I do not know the length of the path!

it could be
$array[$x1][$x2][$x3][$X4]...
or just
$array[$x1]

Therefore so far my only solution is to do this:

 $array['articles']['title']='SAMPLEDATA';
 $key=array(article,titles);
 $keycnt=count($key);

 switch ($keycnt)
 {
   case 1:
   $var=$array[$key[0]];
   break;

   case 2:
   $var=$array[$key[0]][$key[1]];
   break;

   case 3:
   $var=$array[$key[0]][$key[1]][$key[2]];
   break;

   case 4:
   $var=$array[$key[0]][$key[1]][$key[2]][$key[3]];
   break;

   case 5:
   $var=$array[$key[0]][$key[1]][$key[2]][$key[3]][$key[4]];
   break;

   case 6:
   $var=$array[$key[0]][$key[1]][$key[2]][$key[3]][$key[4]][$key[5]];
   break;

   case 7:
   $var=$array[$key[0]][$key[1]][$key[2]][$key[3]][$key[4]][$key[5]][$key[6]];
   break;

   default:
   echo "<br>Error array path is to long";
 }

   echo '<br>VARIABLE CONTENT is: ', $var;

Does not look nice. And if the Array becomes to complicated it might not work anymore. Although I think that for my purpose the above code should be sufficient. But still I am looking for a better solution. Any ideas?

[toplay]

That method won't work. Ideally, one should know the array structure so you know how to get at the data you want. I don't know what you're trying to do specifically.

When you don't know how many dimensions an array is going to be, then you have to check each step of the way and make a recursive function (meaning a function that calls itself).

Below is an example of a function that I have which cleans variable values. It can handle a single non-array variable passed or an array. You must pass a variable to the function and not a value. When the variable is an array it checks if the index value is another array, and if so it calls itself. It loops through all the possible array dimensions. In other words, it can handle arrays of any dimension (1, 2, 3, or more). This would be the kind of recursive function you would need to build for yourself to handle whatever task you need taken care of.

function &clean_values(&$var) {

   if (is_array($var)) {

   foreach ($var as $key => $val) {

       if (is_array($val)) {

           clean_values($var[$key]);

       } else {

           $var[$key] = (get_magic_quotes_gpc()) ? stripslashes(trim(strip_tags($val))) : trim(strip_tags($val));

       }

   }

   } else {

   $var = (get_magic_quotes_gpc()) ? stripslashes(trim(strip_tags($var))) : trim(strip_tags($var));

   }

   return TRUE;
}

$name = "Jack O\'Brian";

clean_values($_POST);  // example of how to call function with an array

clean_values($name);   // or call the function with a single variable

[pasokonkun]

Thank you!!! You gave me the hint!!!!
With your logic I could do what I wanted!
Here is the final code of my test file!

// DEFINE SAMPLEDATA

$array['names']='Jack O\'Brian';
$array['articles']['sport']='Do you like hockey?';
$array['articles']['specials']['php']='Cleaning Values';

// Patharray (uncomment the patharray zou want to test)
// $key=array(names);
//  $key=array(articles,sport);
  $key=array(articles,specials,php);

// CLEAN ALL DATA

 reset($key);  // make sure we start counting correctly   (just in case, here it is not needed)
 clean_values($key);

 reset($array);  // make sure we start counting correctly   (just in case, here it is not needed)
 clean_values($array);

 // CALL THE FUNCTION

 $result=get_result($key,$array);

 // DISPLAY RESULTS

  echo "<br>Result:".$result;
  echo "<br><pre>unchanged ARRAY: ";
        print_r($array);
  echo "</pre><hr>";;

////////////// FUNCTIONS /////////////////////

 function get_result($key,$result)
 {
    function &get_result_innerfunc(&$key,&$arraytoparse)
    {

      if (is_array($arraytoparse))
      {

         $pos=pos($key);
         $arraytoparse=$arraytoparse[$pos];
         next($key);
         get_result_innerfunc($key,$arraytoparse);

      } else
      {
         return TRUE;
      }
 }
 get_result_innerfunc(&$key,&$result);
 return $result;
 }

function &clean_values(&$var) {

   if (is_array($var)) {

   foreach ($var as $key => $val) {

       if (is_array($val)) {

           clean_values($var[$key]);

       } else {

           $var[$key] = (get_magic_quotes_gpc()) ? stripslashes(trim(strip_tags($val))) : trim(strip_tags($val));

       }

   }

   } else {

   $var = (get_magic_quotes_gpc()) ? stripslashes(trim(strip_tags($var))) : trim(strip_tags($var));

   }

   return TRUE;
}
?>

[pasokonkun]

Just a small correction to code above as I got this function already defined error

function get_result($key,$res)
 {
    if (!function_exists(get_result_innerfunc))
    {
       function &get_result_innerfunc(&$key,&$arraytoparse)
       {

      if (is_array($arraytoparse))
      {

         $pos=pos($key);
         $arraytoparse=$arraytoparse[$pos];
         next($key);
         get_result_innerfunc($key,$arraytoparse);

      } else
      {
         return TRUE;
      }
   }
 }
 get_result_innerfunc(&$key,&$res);
 return $res;
 }

(I also changed $result to $res which is a matter of taste)

Thank you again for all your help!