Eval()，有什么意义？
关于 eval() 作为函数的官方文档说：
除此之外，这对于将代码存储在数据库文本字段中以便稍后执行非常有用。
我对此感到非常困惑。 PHP 文档是否建议将 PHP 行存储到数据库中？什么？这不是很不安全的事情吗？
如果我知道数据库中有一个作为 PHP 执行的字符串怎么办？那不是非常危险吗？我只需要一个 Sql 注入来对该网站执行我想要的任何操作，无论我想要什么。我可以删除整个数据库，我可以从脚本中获取所有内容，我可以做任何事情。
这怎么会有这么大的帮助呢？
您能否提供一些示例来说明这个 eval() 如何发挥作用？ 另外，我可能遗漏了一些东西，为什么我看到了一些代码，例如：
eval("if (is_int($int)) { return false }");
而不是只是
if (is_int($int)) { return false }
但是，正如我所说，我可能遗漏了一些东西：什么？
The Official Documentation regarding eval() as function, says:
Among other things, this can be useful for storing code in a database text field for later execution.
I'm seriously confused about that. Is PHP Documentation suggesting to store PHP lines into databases? What? Isn't that something freaking unsafe?
What if i know that in the database there's a string that is executed as PHP? Isn't that extremely dangerous? I just need of an Sql injection to do whatever i want to that site, whatever i want. I can delete the entire database, i can get everything from the script, i can do everything.
How can this be so helpful?
Could you please provide me some examples on how this eval() can be usefull?
Also, i am probably missing something, why have i seen some codes like:
eval("if (is_int($int)) { return false }");
instead of just
if (is_int($int)) { return false }
But, as i said, i am probably missing something: what?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
eval()函数非常棒！人们一直使用它来注入代码并始终获得对服务器的良好访问权限。您经常会看到使用eval()以及在损坏的 WordPress 安装中执行的正则表达式函数。您需要 eval 的原因很少。例如，如果我正在制作一个 PHP 测试网站，人们可以在页面上输入一些代码然后运行它。当然，出于您列出的原因，需要首先对其进行消毒。
The
eval()function is fantastic! People use it all the time to inject code and gain excellent access to servers all the time. You'll often see the use ofeval()and that regex function that also executes, among others, in broken WordPress installations.There are very few reasons why you would need eval. For example, if I were making a PHP testing site where folks could enter some code on a page and then run it. Of course, it would need to be sanitized first, for the very reasons you listed.
假设您有一个允许您输入 PHP 代码的 CMS。我可以看到使用
eval函数来评估该 PHP 代码片段。出于同样的原因，Javascript 也有 eval。抛开所有原因不谈，eval 是非常不安全的。我同意永远不应该使用它。
Let's say you had a CMS that allowed you to type PHP code. I can see using the
evalfunction to evaluate that PHP snippet. Javascript also has eval for the same reason.All reasons aside, eval is very unsafe. I agree it should never be used.
是的，这可能非常危险。我见过它使用的一个地方是一个系统，该系统允许对搜索屏幕进行非常复杂的配置，并允许用户保存搜索配置。搜索的详细信息被保存为作为 eval 执行的实际代码。 输入被单独存储并被检查（在某种程度上，我不知道细节）以防止SQL注入。这是我唯一一次看到这样做，而且可能没有必要（尽管我从未见过足够多的系统来确定）。
当您不知道运行时之前需要执行哪些代码时，
eval()可能很有用（就像我上面给出的示例），但这些情况并不是每天都会发生的事情大多数开发商。如果您确实遇到过需要eval()的情况，请确保您从不 直接传递用户的输入。如果您能找到一种方法来限制（在某种程度上）将传递给它的代码，那就更好了，但这取决于当前的问题。Yes, it can be very dangerous. One place I've seen it used was a system that allowed a very complex configuration of a search screen, and allowed users to save the search configs. The details of the search were saved as actual code that was executed as eval. The inputs were stored separately and were checked (to some degree, I don't know the details) to prevent against SQL injection. That's the only time I've seen that done, and it probably wasn't necessary (though I never saw enough of this system to know for sure).
eval()is potentially useful when you don't know what code will need to execute until runtime (like the example I gave above), but these cases are not the sort of thing that happen every day for most developers. If you ever do run into a situation where you need aneval(), just try to make sure you never directly pass it input from the user. Better still if you can find a way to constrain (to some degree) the code that will be passed in to it, but this will depend on the problem at hand.例如，它被模板引擎使用。它们将模板解析并编译为 PHP 代码，并且可以将代码存储到任何位置，或者直接使用
eval()执行。除此之外，这是一个危险的功能。
It is used by template engines, for example. They parse and compile templates to PHP code, and can either store the code to any location, or execute it directly with
eval().Other than that, it is a dangerous feature.
嗯，这确实不安全，无论如何你都必须清理你的代码。
然而，它并不旨在评估用户或任何其他方式（例如来自数据库）引入的表达式。
我发现当语言不提供元编程时它很有用。例如，您需要用 50 个字段填充一个 bean，这些字段的名称相同，但方法名称略有不同，例如数字（想象它有 field1()、field2()、field3() ... 等） ，那么你可以在 for: 中使用 eval 将方法名称构造为字符串，然后调用它。
这样你就可以将 100 行重复的代码转换为 5 行，如果你想添加有关其工作原理的文档，还可以转换更多行，哈哈。这并不是不安全，因为没有其他人在这里接触您的代码。
Well it is unsafe indeed, you have to sanitize your code anyways.
However it is not intended to evaluate expressions introduced by users or any other means such as from DB.
I've found it usefull when the language does not provide metaprogramming. So for example you need to fill a bean with 50 fields that are called the same but with a small difference in the method name such as a number (imagine it has field1(), field2(), field3() ... etc), then you can use the eval inside a for: construct the method name as a string and then call it.
This way you can convert 100 repetitive lines of code in 5, a couple more if you want to add documentation on how it works lol. It is not unsafe because nobody elses touches your code here.
你可以有类似的东西
在 eval $text 中将被替换为“这是一些随机数：$number。Hello world！”，并且 eval 确保 $number 也被替换为 15
You can have something like
In the eval $text would be replaced by "This is some random number: $number. Hello world!", and eval makes sure that $number is also replaced by 15