catching errors from eval

adrive

according to references i read, it seems that it is not possible to capture errors from eval function with set_error_handler.

even on php.net itself there were people talking about it :

http://readlist.com/lists/lists.php.net/php-general/5/29802.html

a simple example that shows that the custom error handler isn't called upon eval's error :

<?php
function errorHandler($errno, $errstr, $errfile, $errline) {

$errMessage = "<b>Error :</b> message '" . $errstr . "'".
		" of file " . $errfile . " line " . $errline;

echo $errMessage;
//do something here


}
set_error_handler('errorHandler', E_ALL | E_PARSE | E_COMPILE_ERROR | E_CORE_WARNING | E_CORE_ERROR);

$toval = "getNameFunction();";

eval($toval);
?>

IS the only way to capture these errors done through manual checking? Like checking for eval that returns FALSE ?

NogDog

I don't have any specific recommendation, other than to reconsider the whole need for using eval() at all. As per a quote attributed to Rasmus Lerdorf, the creator of PHP, "If eval() is the answer, you're almost certainly asking the wrong question."

adrive

NogDog wrote:
As per a quote attributed to Rasmus Lerdorf, the creator of PHP, "If eval() is the answer, you're almost certainly asking the wrong question."

That sounds serious enough 😉

bradgrafelman

Well it's quite true, I always offer the same quote (although I can never remember it's origin).

For example, why use eval() in your code? There's no need to if you're simply calling a function based on a variable:

function billy($txt) {
	echo $txt;
}

$bob = "billy";
$bob('testing'); // outputs "testing"

adrive

actually it's not that simple. i'm currently on a framework that uses eval to execute codes base on a database.

it so happens that it might contain a class method, such as $this->getMyName() or sometimes it might contain a function, getMyName() itself.

so i can't use function_exists or method_exists either since i won't know when which type of calls are used.

I know eval returns FALSE if there is a parse error, but is there no other way to check based on a certain type of error it is sending since parsed functions can return false?

adrive

anyone?

NogDog

Well, you could grab the text from the DB, write it to a file, include/require that file, then delete it. If the data is just PHP code snippets, you'll probably have to prepend a "<?php" tag and append a "?>" tag when you write it to the file.

Of course, all these machinations are an indication of how kludgy this whole concept of executing code from the DB is, not to mention the potential security problems should someone manage to sneak some malicious code into the DB. Personally, I'd rather see you create functions/classes in regular files, then have the DB just store information that would instruct the script as to which functions/classes to require and execute, along with any parameters to be supplied.