Home/ Questions/Q 3350004
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-18T01:44:03+00:00

I want to make a programming environment. I will explain it with an example.

  • 0

I want to make a programming environment. I will explain it with an example.

One programmer will write that code;

<html>
 <head>
  <?php definedMetaTags(); ?>
 </head>
</body>

Programmer will save this file and then upload to my system. That file will be executed at server side and then they system will turn generated code back.

That definedMetaTags() function will be already written in the system.

An example of Compiler.php:

<?php
 require_once("definitionsForProgrammer.php");
 include("uploadedfile.php");
?>

My question is that I want to allow that uploadedfile.php only what functions I want. Else, maybe that programmer writes some codes what I want him/her to do. (Deleting files, mysql connection, etc.)

Is there any way to allow a code only specific functions, variables, constans?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    If you’re aiming for security and you want to let them to write functions, then the short answer is: no.

    Essentially you’re asking for a PHP sandbox which will let you constrain what code can be executed. PHP would have to support this at a fundamental level for it to work. For example, supposing you took the approach of saying “I only allow the user to write a function named ‘foo'”. Inside that function, though the user can do all kinds of bad things like making system calls, downloading other code and executing it, etc. In order to prevent this you’d need to implement checks at a much lower level in the system.

    If you’re willing to restrict the scope only to variable definitions then yes you can do it. You can use token_get_all() and token_name() to examine the file to make sure that it doesn’t have any code that you don’t want in it. For example:

    foreach (token_get_all(file_get_contents("uploadedfile.php")) as $token) {
  if (is_array($token)) {
    echo token_name($token[0]), " ";
  } else {
    echo $token;
  }
}

    If you don’t like any tokens you see, don’t include the file. You could theoretically guard against bad functions this way as well, but it’ll require a fair amount of effort to properly parse the file and make sure that they’re not doing something bad.

    references:

    • 0