$_POST and execute

[granpa]

I have some encoded code and if I change eval to $some, then add:

$some= ereg_replace('eval', 'echo', $some);
eval ($some); before ?> I get the decoded.

Im trying to build a little script which would do this, using $_POST, but it dont echo the decoded it just echos whats been inserted.

Heres the code which I've come up with:

<form action="index2.php" method='post'>

<textarea name='so' rows="8" cols="20"></textarea><br>


<input type='submit' name='submit' value='Submit'/><br>
</form>

<?php
$so = $_POST['so'];
$so = str_replace('?>', "", $so);
$so = str_replace('eval($_G', '$some($_G', $so);
$submit= $_POST['submit'];
if($so == "") echo "";
else {
    if($submit == "Submit") {
echo $so;
$some= ereg_replace('eval', 'echo', $some);
eval ($some);
echo "?>\n";
    }
}
?>

All help is greatly apreciated.

Thank You.

[johanafm]

You've just mixed up variable names ($so and $some). Also, ereg_* have been deprecated as of 5.3, and are not in 6.0 at all. Don't use it.

Also, your code is highly dangerous, and I strongly advice against it. It's an open invitation for people to do seriously nasty stuff to your machine. Evaling user input lets them do anything you could do yourself. Sending spam mail from your machine is just one of many fun possibilities. unlinking files for you is another.
The only thing they can't do is run eval() themselves, but that really is all.

Also, if (!empty()) or if (isset()) on $POST is a good idea.
But

$so = $_POST['so'];
$so = str_replace('?>', "", $so);
$so = str_replace('eval($_G', '$some($_G', $so);
$submit= $_POST['submit'];
if($so == "")
	echo "";
else {
    if($submit == "Submit") {
		echo $so;
		$so= ereg_replace('eval', 'echo', $so);
		echo "<br/>eval($so): ";
		eval ($so);
		echo "<br/?>\n";
    }
}

[granpa]

I get:

"eval( Parse error: syntax error, unexpected '<'"

Also I think you slightly misunderstood this is how it works:

I have some encoded code and if I change eval to $some, then add:

$some= ereg_replace('eval', 'echo', $some);
eval ($some); before ?> I get the decoded.

You've changed the eval.

[johanafm]

ereg_replace('eval', 'echo', $some);

This means: find all occurences of 'eval' in $some and replace them with 'echo'.

Since $some is not defined prior to this point, you will get an empty string, which is then assigned to $some, and that's why you get no output.

[granpa]

I input encoded text in the textarea, and then $some is defined to the inputted text, and echos the result.