Ошибка php eval d code on line

If eval() is the answer, you're almost certainly asking the
wrong question. -- Rasmus Lerdorf, BDFL of PHP

<pre>
Inception Start:
<?php
eval("echo 'Inception lvl 1...n'; eval('echo "Inception lvl 2...n"; eval("echo 'Inception lvl 3...n'; eval('echo \"Limbo!\";');");');");
?>

<?phpecho eval( '$var = (20 - 5);' );  // don't show anythingecho ' someString ' . eval( 'echo $var = 15;' ); // outputs 15 someString

//or

echo ' someString ' . eval( 'echo $var = 15;' ) . ' otherString '; // 15 someString  otherString 

//or

echo ' someString ' . eval( 'echo $var = 15;' ) . ' otherString ' . '...' .eval( 'echo " __ " . $var = 10;' ); // 15 __ 10 someString  otherString  ...?>

<?php

$test

= '2+3*pi';// Remove whitespaces
$test = preg_replace('/s+/', '', $test);$number = '(?:d+(?:[,.]d+)?|pi|π)'; // What is a number
$functions = '(?:sinh?|cosh?|tanh?|abs|acosh?|asinh?|atanh?|exp|log10|deg2rad|rad2deg|sqrt|ceil|floor|round)'; // Allowed PHP functions
$operators = '[+/*^%-]'; // Allowed math operators
$regexp = '/^(('.$number.'|'.$functions.'s*((?1)+)|((?1)+))(?:'.$operators.'(?2))?)+$/'; // Final regexp, heavily using recursive patternsif (preg_match($regexp, $q))
{
    $test = preg_replace('!pi|π!', 'pi()', $test); // Replace pi with pi function
    eval('$result = '.$test.';');
}
else
{
    $result = false;
}?>

I can't guarantee you absolutely that this will block every possible malicious code nor that it will block malformed code, but that's better than the matheval function below which will allow malformed code like '2+2+' which will throw an error.

public function generateClassMap()
    {
        foreach ($this->classMap as $tableName => $class)
        {
            $c = null;
            eval('$c = new class extends commonMyStaticClass {
                public static $tableName;
                public static function tableName()
                {
                    return static::$tableName;
                }
            };');
            $c::$tableName = $this->replicationPrefix.$tableName;
            $this->classMap[$tableName] = $c;

        }
    }

thus every class will have its own $tableName instead of common ancestor.

<?php
    eval( '?> foo <?php' );
?>

does not throw any error, but prints the opening tag.
Adding a space after the open tag fixes it:

<?php
    eval( '?> foo <?php ' );
?>

$res = eval($somecode);

if(!$res) {
    echo "<pre>";
    print_r(explode(PHP_EOL, $somecode));
    echo "</pre>";
}

I know it is terrible but I didn't have much of a choice. None of the try...catch solutions worked for me; the solution above shows the exact lines with numbers and it is easy to find what's wrong with the code.

$res = eval($somecode);

if(!$res) {
    echo "<pre>";
    print_r(explode(PHP_EOL, $somecode));
    echo "</pre>";
}

I know it is terrible but I didn't have much of a choice. None of the try...catch solutions worked for me; the solution above shows the exact lines with numbers and it is easy to find what's wrong with the code.

<?phpfunction init($trait, $class) {
    return (trait_exists($trait) && class_exists($class))
        ? eval("return new class() extends {$class} { use {$trait}; };")
        : false;
}

trait

Edit {
    function hello() { echo 'EDIT: ' . $this->modulename; }
}
trait Ajax {
    function hello() { echo 'AJAX: ' . $this->modulename; }
}
class MyModule {
    public $modulename = 'My Module';
}
class AnotherModule {
    public $modulename = 'Another Module';
}init('Edit', 'MyModule')->hello();      # 'EDIT: My Module'
init('Ajax', 'AnotherModule')->hello(); # 'AJAX: Another Module'?>

<?php
class Fruit
{
    public $tomato = "Tomatos";

    public function

red() {return " are red. ";}
}$fruit = new Fruit;
$fruitStr = "tomato";
$colorStr = "red";

echo

$fruit->$fruitStr . $fruit->$colorStr();// and procedural  //////////////////////////////////////////$lemon = "Lemons";

function

yellow() {return " are yellow. ";}$fruitStr = "$lemon";
$colorStr = "yellow";

echo

$fruitStr . $colorStr();
?>

<?php
function betterEval($code) {
    $tmp = tmpfile ();
    $tmpf = stream_get_meta_data ( $tmp );
    $tmpf = $tmpf ['uri'];
    fwrite ( $tmp, $code );
    $ret = include ($tmpf);
    fclose ( $tmp );
    return $ret;
}
?>

- why? betterEval follows normal php opening and closing tag conventions, there's no need to strip `<?php?>` from the source.  and it always throws a ParseError if there was a parse error, instead of returning false (note: this was fixed for normal eval() in php 7.0). - and there's also something about exception backtraces

<?php

$str

=  '<?php echo "test"; ?>';

eval(

'?>'.$str.'<?php;'); // outputs test

eval('?>'.$str.'<?'); // outputs test

eval('?>'.$str.'<?php');// throws syntax error - unexpected $end
?>

<?php
$return = eval( 'parse error' );

if (

$return === false && ( $error = error_get_last() ) ) {
    myErrorHandler( $error['type'], $error['message'], $error['file'], $error['line'], null );// Since the "execution of the following code continues normally", as stated in the manual,
    // we still have to exit explicitly in case of an error
    exit;
}
?>

Example:

<?php

$filename = preg_replace('@(.*(.*$@', '', __FILE__);

echo $filename;

?>

So:
<?PHP
class foo {
  //my class...
}
function load_module($module) {
  eval("global $".$module."_var;");
  eval("$".$module."_var=&new foo();");
  //various stuff ... ...
}
load_module("foo");
?>

becomes to working:

<?PHP
class foo {
  //my class...
}
function load_module($module) {
  eval('$GLOBALS["'.$module.'_var"]=&new foo();');
  //various stuff ... ...
}
load_module("foo");
?>

Note in the 2nd example, you _always_ need to use $GLOBALS[$module] to access the variable!

Use a call_user_func() inside eval() to call your personal hand made functions.

This is user function
<?phpfunction square_it($nmb)
{
    return $nmb * $nmb;
}?>

//Checking if eval sees it?
<?php

$code

= var_export( function_exists('square_it') );

eval(

$code );    //returns TRUE - so yes it does!?>

This will result in a fatal error:
PHP Fatal error:  Call to undefined function square_it()
<?php

$code

= 'echo square_it(55);' ;

eval(

$code );?>

This will work
<?php

$code

= 'echo call_user_func('square_it', 55);' ;

eval(

$code );?>

This:

a. Prevents Flash of White in Chrome or Firefox (where an external css file arrives briefly too late to render the HTML).

b. Allows radical minifying by testing the page source to see if whole blocks of rules or code are even required, such as for tables.

c. Allows custom source-content-dependent css rules to be created on the fly. (I use this to create rules for positioned labels over an image that scale with it)

d. Allows generation of a hash of the processed css or js for use in the page's CSP header for style-src or script-src to prevent injection attacks.

Here eval() is safe because it is not using user-supplied (person or browser) information