0

I'm trying to hash a string and salt using a custom algorithm which is user supplied. However, the $algo variable always appears as a string and thus the output is clearly the value of the input as a string.

<form method='POST'>
    <input type='text' name='pass'>
    <input type='text' name='salt'>
    <input type='text' name='algo'>
    <input type='submit' value='Hash'>
</form>

<?php

$pass = $_POST['pass'];
$salt = $_POST['salt'];
$algo = $_POST['algo'];

eval('echo $algo;');
schmitsz
  • 175
  • 1
  • 13

1 Answers1

2

In order to pass the variable $algo in your string, you need to use double quote "

eval("echo $algo;");
maalls
  • 749
  • 8
  • 20