Checking variables using the eval()-Function

Question

I have a list of variables (var1, var2, ...). Now I'd like to check these variables using several conditions and print out an error message if the condition is true.

As there are many "checks" that should be done I saved the "conditions" in a MySQL-DB (varchar):

condition               errormsg
--------------------------------------------------------
$var1!=1 && $var1!=2    var1 should be 1 or 2
$var1==''               var1 is missing
$var3<0 & $var3>10      var3 should be between 0 and 10

Now I'd like to check these variables using the eval-Function:

$res=mysqli_query($con, "SELECT * FROM conditions");

while($row=mysqli_fetch_object($res)){
 if(eval($row->condition))
  echo $row->errormsg;
}

Can this work or is there a better solution without eval()? Thank you for your help!

Answer 1

Many people suggest to get alternate of this . But if you really need this you can do this way. I don't have your data so I have made this with my own way

 <?php
    $condition = "1!=1";
    //$condition = "1==1";
   $error = "test";
   eval("\$con = $condition ;");
   if($con){
   echo $error;
   }else {
  echo "not found";
  }
?>

Uncomment second line to get another change. Just keep in mind that statement should be complete in eval function.

Live demo : https://eval.in/847626

Pay special attention not to pass any user provided data into it without properly validating it beforehand.

Answer 2

The common solution for your problem is to write validation functions for the variables. Such a function receives a variable as argument, checks its value and return either success or an error code. Then the calling code uses the error code to lookup the error message in the list of localized strings for the current language.

It could be like below:

The validation functions

function var1_is_valid($var1)
{
    if ($var1 == 1 || $var1 == 2) {
        return 'SUCCESS';
    } else {
        return 'ERR_VAR1_INVALID';
    }
}

function var1_is_present($var1)
{
    if ($var1 != '') {
        return 'SUCCESS';
    } else {
        return 'ERR_VAR1_MISSING';
    }
}

function var3_is_valid($var3)
{
    if (0 <= $var3 && $var3 <= 10) {
        return 'SUCCESS';
    } else {
        return 'ERR_VAR3_INVALID';
    }
}

The language file(s)

// Use the strings returned by the validation functions as keys in the array
$lang = array(
    'ERR_VAR1_INVALID' => 'var1 should be 1 or 2',
    'ERR_VAR1_MISSING' => 'var1 is missing',
    'ERR_VAR3_INVALID' => 'var3 should be between 0 and 10',
);

Even better, you can combine the functions var1_is_valid() and var1_is_present() into a single validation function for $var1 that returns either 'SUCCESS' or the appropriate error string.

All the error messages for a language stay in a single language file that is loaded on each request. It works faster than querying the database for the error messages.

Another language means another file with strings identified by the same keys. You won't use two language on the same time. At most, you load the language that is completely implemented before loading the language requested by the user, in order to have a value for each string (a message in the wrong language is still better than nothing).

Answer 3

You can use a pseudo-switch, eliminating the need for a db and eval(). Minimalistic example:

$var = 1;
switch(true){
    case ($var == 1):
        echo "1\n";
    case ($var != 2):
        echo "2\n";
}