Using eval on mysql data, is my code vulnerable, if so what is a better alternative

Question

I am using the information_schema.columns table to grab some information.

I just want to know if this is a bad idea and whether there is a better alternative.

    if($column['DATA_TYPE'] === 'enem'){
        $options = eval(str_replace('enem(', 'array(', $column['COLUMN_TYPE']));
    }

I chose to use eval and a single str_replace as i thought it was the fastest method of creating the array.

Here is an example of what $column could look like

$column = array(
    ['COLUMN_NAME'] => 'status',
    ['COLUMN_TYPE'] => "enum('failed','success','pending','other')",
    ['DATA_TYPE'] => 'enum',
);

Yes this is probably a terrible idea. Why do you think you need `eval`? What are you trying to do? — PeeHaa, Dec 22 '15 at 11:55
@PeeHaa i chose to do it this way because i thought it was the fastest way of getting the data. — TarranJones, Dec 22 '15 at 11:56
You would be much better of just properly parsing it. For which there are several duplicates found on SO. — PeeHaa, Dec 22 '15 at 12:05

score 1 · Accepted Answer · edited May 23 '17 at 11:52

1

I think your second solution is much more clear and the difference in speed and memory performances will be minor. (You could also use RegExp)

Here is a link which can help you:

How can I get enum possible values in a MySQL database?

edited May 23 '17 at 11:52

Community

1
1

answered Dec 22 '15 at 23:24

Tony Vlcek

446
4
18

score 0 · Answer 2 · answered Dec 22 '15 at 12:20

0

Here is one not eval alternative, probably not as quick as the eval but still fast

if($column['DATA_TYPE'] === 'enem'){
    $enums = str_replace(array('enum(', ')'), '', $column['COLUMN_TYPE']);
    $options = explode(',', $enums);
}

More checks might need to be done but it works for enum('failed','success','pending','other')

answered Dec 22 '15 at 12:20

TarranJones

4,084
2
38
55

Your example does not work the same way. You get strings like this: `"'failed'"`. I.e. you have to remove the ' after explode. – frodeborli Dec 22 '15 at 23:41

score 0 · Answer 3 · answered Dec 22 '15 at 23:40

The only real reason not to use eval() in this case is because you want your code to run on for example HHVM by Facebook, which does not support eval afaik. I see no security problems in your particular case, however.

However, if you simply change your code slightly, you could use json_decode:

$options = json_decode('['.substr($column['COLUMN_TYPE'], 5, -1).']);

It's hard to tell which is faster without doing a small benchmark. I suspect this is faster, because str_replace has to search the entire string.

Using eval on mysql data, is my code vulnerable, if so what is a better alternative

3 Answers3