Why do we have to use ? > <?php when we use Eval in the content of a php script?

Asked

Viewed 1,636 times

7

I took a look at the source code of Laravel 3 and saw the following code:

eval('?>'.$__contents);

On other occasions, I’ve seen something like:

$content = file_get_contents('file.php');
eval('?>' . $content . '<?php');

Why do we have to use ?> and <?php when we use the function eval in a content of a PHP script?

Is there any special reason for it?

php eval

  • you don’t have to use it. Eval takes content from a string and validates it as PHP code. Since you are including a PHP file you probably have the tag "<? php" inside it that will conflict with the opening tag (<?php) that is in the file that is calling Val. Same thing for closing tag. So basically it closes the PHP tag on Eval, includes another script opens the tag to continue the script

2 answers

7


How does the eval:

The eval executes a string as a normal PHP execution, example:

$x = 2;
$y = 3;
$z = eval('return $x + $y;');
eval('echo $z;');

The above example will print 5 on the screen, because in line 3 the Eval returned the result of the sum of the variables $x and $y and on line 4 the eval printed on screen with echo. Now we have an idea of how the eval works.

Why use '?>':

$content = file_get_contents('file.php');
eval('?>' . $content . '<?php');

Imagine the file structure file.php begins like this:

<?php
  // faça algum procedimento...

So when Eval runs it will open the PHP tag, which in this case is already opened by the current code running Eval, then in that case the eval should close it:

$content = file_get_contents('file.php');
eval('?>' . $content);

Such an execution would be:

$content = file_get_contents('file.php'); // apartir da próxima linha é a execução do `eval`
?><?php
  // faça algum procedimento...

So even if the file started with text (or HTML) there would be no problems:

$content = file_get_contents('file.php'); // apartir da próxima linha é a execução do `eval`
?><html>
     <head>
     <!-- restante do código -->

Close or not to tag ?> in the eval?

In the case of closure it is the same thing, but a little more complicated in some cases.

Imagine now that the file file.php end with

// Termino dos procedimentos
?>

Then the tag PHP for PHP to continue running, otherwise the lines of code after the eval will be printed as text, example:

$content = file_get_contents('file.php');
eval('?>' . $content.'<?php');
$sql = "INSERT INTO users (user, pass) VALUES ('admin', '123456')";

In the above example, if the $content close the php tag ?> and if it was not reopened, the next lines, such as the variable $sql would be printed on the screen for anyone who wants to see. This would be a big problem, since PHP allows and is even recommended not to close the TAG when there is no buffer output.

The safest way to avoid this problem is to check all lines of code, and see whether or not there is a last occurrence of the closing tag ?>.

Routine example to check whether the PHP tag is open or closed.

function checkTagPHP($linhas){
   $php = NULL; 
   foreach ($linhas as $linha) {
      $aber = strrpos($linha, '<?php');
      $fech = strrpos($linha, '?>');

      if ($aber > -1 && $fech > -1)
        $php = ($fech < $aber);
      else if ($aber > -1)
        $php = TRUE;
      else if ($fech > -1)
        $php = FALSE;
   }
   return $php;
}
$php = checkTagPHP($arrayDeLinhasDoCodigo);
// Após o loop
// $php == NULL  -> Não existe tag PHP no código
// $php == TRUE  -> Tag PHP aberta
// $php == FALSE -> Tag PHP Fechada

So you can make the decision whether or not to close the PHP tag:

$content = file_get_contents('file.php');
$execute = '?>' . $content;

if (!checkTagPHP($content)) // Se Tag php estiver fechada
  $execute .= '<?php';

eval($execute);

Obs.: The above code has not all been tested, there may be some syntax error.

  • I couldn’t play this case of activating HTML mode inside the eval and this affects the PHP code after the eval: http://ideone.com/4zra5T

3

The eval PHP expects to receive a snippet of code valid, but allows you to switch to "HTML mode". For example, this excerpt, adapted from an example of the manual

eval('echo "In PHP mode!"; ?>In HTML mode!<?php echo "Back in PHP mode!";');

gives the following output:

In PHP mode!In HTML mode!Back in PHP mode!

That is, the eval "spits" back content that is in HTML mode if it is properly informed that it is in that mode.

The excerpts you quoted in the question take this into account, and try to ensure that the content passed to eval as any variable ($__contents or $content) is interpreted in HTML mode. That is, this code was made to handle contents of this type:

<h1>HTML Normal</h1>
<h2><?php echo $valorVindoDoBanco ?></h2>
...

No precaution to force entry into HTML mode with ?>, that code would generate a syntax error when executed by eval.

Browser other questions tagged php eval

You are not signed in. Login or sign up in order to post.