I have got string response is "<?php $a=array("10","20"); echo $a[0]+a[1]; ?>"
How to execute this string. I use PHP 7.0.
Please give any solution.
Asked
Active
Viewed 5,372 times
0
localheinz
- 9,179
- 2
- 33
- 44
Renuka s
- 53
- 1
- 5
-
2Why is this tagged with json, laravel, codeigniter and yii? Looks like tag-spamming. – M. Eriksson Jul 24 '17 at 13:07
-
You can use `eval()` but is rare and dangerous it use, why tou got this response string ? – kip Jul 24 '17 at 13:08
-
corrected `echo $a[0]+$a[1];` – Suneel Kumar Jul 24 '17 at 13:08
-
1You could use http://php.net/manual/en/function.eval.php and open yourself to a variety of security problems. Also see https://stackoverflow.com/questions/951373/when-is-eval-evil-in-php/951868. – localheinz Jul 24 '17 at 13:08
-
Out of curiosity, where does the string come from and why do you need to execute it? – M. Eriksson Jul 24 '17 at 13:10
1 Answers
7
As already stated you can use eval($string);. Beware that eval() evaluates a string as PHP code, so you need to be careful with the strings you allow to be passed!
If you take the string yourself from a predefined set of strings you created (using a swtich statement or something similar) it shouldn't be a problem.
If the string comes from the outside (user input or cURL requests or whatever) you shouldn't trust it and you should avoid using this method.
Antoniu Livadariu
- 171
- 7
-
-
@Renukas, I know it is tooooo late to comment smth here, but mb it will be helpful for someone else. Beware too, because $string could contain "", so in your example, you aren't avoiding executing php code – BedOmar Jul 31 '22 at 05:00