par
Ripat » 11 mars 2006, 15:01
je vais tester ça, merci. Mais pourquoi est-ce déconseillé d'utiliser eval?
Principalement pour éviter d'ouvrir son serveur à des injections de code malicieux.
Voici un peu plus d'info:
Eval’s Inherent Security Risk
Eval by its nature is always going to be a security concern. You taking a string from an external source and bringing it into your PHP script, you can think of attacks of this nature to being equivalent to SQL injection though they can generally cause a lot more damage ($GLOBALS generally contains your DB password and PHP has lots of filesystem functions). Now proper escaping and data cleaning should mitigate these risks but its easier to just avoid them whenever possible.
Uses of Eval
Eval has 3 primary uses, providing compatability between php versions, generating class definitions and logic at runtime, and call functions with variable names. Now when we look at these 3 use cases the actual when to use eval choice breaks down like this: using eval for compat is great, for logic is good if there is no other way, and NEVER to call functions.
La fin du texte est catégorique:
...and NEVER to call functions.
Source:
http://blog.joshuaeichorn.com/archives/ ... al-in-php/
Mais j'imagine que tu devrais trouver d'autres commentaires sur le sujet.
[quote="Anonymous"]je vais tester ça, merci. Mais pourquoi est-ce déconseillé d'utiliser eval?[/quote]
Principalement pour éviter d'ouvrir son serveur à des injections de code malicieux.
Voici un peu plus d'info:
[quote]Eval’s Inherent Security Risk
Eval by its nature is always going to be a security concern. You taking a string from an external source and bringing it into your PHP script, you can think of attacks of this nature to being equivalent to SQL injection though they can generally cause a lot more damage ($GLOBALS generally contains your DB password and PHP has lots of filesystem functions). Now proper escaping and data cleaning should mitigate these risks but its easier to just avoid them whenever possible.
Uses of Eval
Eval has 3 primary uses, providing compatability between php versions, generating class definitions and logic at runtime, and call functions with variable names. Now when we look at these 3 use cases the actual when to use eval choice breaks down like this: using eval for compat is great, for logic is good if there is no other way, and NEVER to call functions.[/quote]
La fin du texte est catégorique: [b]...and NEVER to call functions.[/b]
Source:
http://blog.joshuaeichorn.com/archives/2005/08/01/using-eval-in-php/
Mais j'imagine que tu devrais trouver d'autres commentaires sur le sujet.