[man]eval/man is probably disabled because if someone were to add say...
phpinfo(); exit();
as the value of one of the inputs, and then purposefully fails the form validation, they could conceivably ascertain all the information about your system (what's installed, version of php, etc.). From there, they could easily do things like var_dump() or use Reflections to see what your code is doing, and eventually hack your code from the outside.
That's usually why it's left "off" or disabled in production environments. The only way to guarantee that it won't be mistreated is to have a select few functions that you'll allow, and if inside the eval'd code there are other functions, then don't allow it to be run.
It's a catch-22. On one hand you gain functionality, on the other, you expose a security risk. Most hosts will err on the side of caution and disable it (both for your and their protection).
I think your best bet will be to change the forms to use some type of templating system. Whether that means that you roll your own and use tags like:
<mySystem:input type="text" name="somename" value="_SESSION['somekey']" class="some_class" />
and then you parse it and display:
<input type="text" name="somename" value="I Was In The Session!" class="some_class" />
Or you could make it as simple as Brad said and use {:var_name:} and then do a str_replace() looking for all {🙁.*):} items and when you find it, replace it with $_SESSION items.
