Question

I have a eval function like this

if(FALSE === @eval($code)) echo 'your code has php errors';

So if the code has synthax errors it will return that message.

The problem is that if within the code you have something like:

  require_once('missing_file.php');

it will just break the page, without my nice error message 🙁

Is there any workaround for this?

Answer 1

Well, first I hope that $code comes from a trusted source and that you’re executing arbitrary code sent by the users.

Second, the only way I see you can workaround that is to save $code into a file, run it with the command line PHP interpreter, and check the exit value. Note that passing this test doesn’t make $code fatal error free, it just so happened that this particular execution of the script did not throw any fatal error; there may be other code paths that trigger such an error.

This is because once eval triggers a fatal error, it can’t be recovered and the script dies. eval only returns FALSE if there is a parsing error.