Question

Is there any security problem with dynamically calling a method in a class from user input. For example:

<?php
    class A {
        public function foo() {
            return true;
        }
    }

    $obj = new A();

    $method = $_GET['method'];

    $obj->$method();

I am aware that the user will be able to call any method within A, and I am fine with that. I am just curious if there may be other possible security issues.

Answer 1

Your user will be able to try calling any possible method from your class — even try to call non-existant methods (and get a Fatal Error).

If you’re fine with this… well, I suppose this is OK.

It doesn’t look nice, but I don’t think one could inject any other kind of code.

Still, I would at least check if the method exists — using [**`method_exists()`**][1]