[RESOLVED] eval() no output

owaring

can i use eval() on code stored in a $var and not have it output
but instead have all that it would output saved into another $var so i could echo it later????

rsmith

Try something like:

$var1 = eval($var2);

You would then output it bye echo'ing $var1

laserlight

You would use output buffering, e.g.,

<?php
ob_start();
eval('echo "Hello world!";');
$str = ob_get_contents();
ob_end_clean();

echo 'The eval output is: "' . $str . '"';
?>

That said, are you sure eval() is the right solution in the first place? Avoid eval() if it is feasible to do so.

saidbakr

Keep eval() away, if there is any user input should be included by it.

owaring

i realize the importance to keep eval() away form user input.

what could i do instead of using eval()??

laserlight

Well, what are you trying to do that you think eval() can solve?

owaring

I'm getting php code from a database (an existing system I'm writing an add on to)

which i need to parse and output (when I'm ready!)

laserlight

Oh, in that case you have no choice but to use eval(). The poor decision was made before you arrived.

owaring

laserlight wrote:
Oh, in that case you have no choice but to use eval(). The poor decision was made before you arrived.

poor decision in storing php in database?? would you mind explaining

laserlight

poor decision in storing php in database?

It can be a source of security problems.

saidbakr

Hi,

In most cases when you have to use eval() there is no thing to do else using eval(). However, the usage of eval() should be apply what we may call Fully controlled usage of eval(). This behavior may seem like securing or validation of forms. The full control of eval() requires pre-validation and examination of its arguments before its execution. For example, applying your case, you should be sure that records that contains string that is going to be evaluated is controlled and has the content you expect. In other word, users has no ability to change this records for example and for step 1 should the evaluated record to be record number 1 not 2.

You should be assured that the evaluated string could not be changed with other string.