lord2800 / noeval

A PHP extension to disable the eval language construct

PHP Extension to disable eval

Disables the eval language construct, since it can't be disabled via the disabled_functions INI setting. I got tired of waiting for suhosin to be ready for PHP 7.0, especially with 7.1 around the corner, so I decided that since all I really need from it is to disable eval, I wrote an extension to do just that.

Build instructions

1. git clone https://github.com/lord2800/noeval
2. cd noeval
3. phpize
4. ./configure
5. make
6. make install

Works for PHP 5.6 and PHP 7, possibly more versions but I haven't explicitly tested it.

noeval's Issues

Installs, phpinfo shows it disabling eval... doesn't disable eval

There may be a detail I'm missing here, but here's my experience. I followed the instructions, built the module, loaded the module into php.ini, then ran php on the following script:

echo("Test\n");
eval('echo("Eval Test");');

The expected result would be for the eval function to fail. Instead it runs just fine.

php -i shows:

noeval
eval => disabled

Now, technically that's php71 -i since I'm using the remi repo for php 7.1 on CentOS 7. No idea if that makes a difference, or how if so.
Also, when I run phpinfo() through apache, the noeval section shows that eval is disabled, but again whether via command line or via apache, the eval code still runs.

Packaging

I don't know the first clue about how to package PHP extensions for any OS. 😞