There are a shed-load of ways to “eval()” code without actually calling the eval() function — usually done simply to avoid the use of the dreaded “evil()” function, but often times because the system has eval() disabled using “disable_functions” in php.ini
Here is another simple way to avoid eval() without writing out files to the filesystem etc:
$code = ‘<?php echo “Hello World”; ?>;
include(‘data:text/plaintext;base64,’ . base64_encode($code));
This uses the new data: stream wrapper (RFC2397) that was introduced with PHP 5.2.0; and while this seems like a risk, first: The “attacker” already has access to the code on your system, or you’re open to injection anyway, second: PHP 5.2 has also fixed the problem with the introduction of the ”allow_url_include” php.ini option.
I just thought it was a neat little streams “hack” I would share; I originally thought to do it using the var stream from PHP’s stream_wrapper_register() documentation, but then Evert Pot posted about creating streams from strings using the data: stream, which led to this final “solution”.
@ChiperSoft aaaah, ours is 8-7:30 or later. That came at about 10 months too. Also wife gets up early, I sleep in. Except sunday. :D@dshafik [17 hours ago]
@dshafik oh she mostly sleeps through the night, but she wakes up at 6am, and we both like 8hrs of sleep :)@ChiperSoft [17 hours ago]