Question

if i take and do something like this:

    $p = 10;
    $n = 3;
    $evalstr = "\$f = 0.99 + ((.025 * \$p) * \$n);";
    eval($evalstr);
    echo $f;

I get 1.74 displayed, no errors everything is fine, but when I have a mysql table that holds these equations (for the purpose of this example, it is the exact same equation)…like so:

    $p = 10;
    $n = 3;
    while ($result = mysql_fetch_assoc($results)) {
        $math = $result['math'];
        //at this point $math = "\$f = 0.99 + ((.025 * \$p) * \$n);"
        eval($math);
    }

I get Parse error: syntax error, unexpected T_VARIABLE, expecting T_STRING in ajax\getprices.php(30) : eval()’d code on line 1

Unsure as to why, if i print of echo $math is it identical to what I have as $evalstr in the first example. $p and $n are actually set from GET variables but even if I set them manually as in the example it does not work.

Answer 1

It seems to me, that you stored the expression including the escaped $ in the database. You might try, if it works, if you first remove the slashes:

eval(stripslashes($math));

I too would recommend to be very careful with storing such code in a database and using eval to execute it. There is potential for security holes here. But i assume, you know this.