Is this php function safe

Question

This is not my full code. I am just posting the relevant parts. In my current application the user does not have access to manipulate the variables so it is safe but in future I may write something where they can so while I am thinking about it I wanted to ask if there is anyway to hack this code.

define('SMART_TAG_FOLDER','includes/smartTag/');
function loadExternalFunction($functionName,$fields) {
    //get file function should reside in
    $fileName=$functionName;
    $fileEnd=strpos($functionName,'_');
    if ($fileEnd!==false) {
        $fileName=substr($fileName,0,$fileEnd);
    }
    $fileName.='.php';

    //try to load file function should be in
    if (file_exists(SMART_TAG_FOLDER . $fileName)) {
        require_once SMART_TAG_FOLDER . $fileName;
    }

    //if desired function exist then execute
    $functionName='smartTag_'.$functionName;

    if (function_exists($functionName)) {

        //run function
        $evalRun='$value=' . $functionName . '($fields);';
        eval($evalRun);
        return $value;
    }
    return false;
}

my thoughts is the use of file_exists, and function_exists along with adding information to the user defined variable $function it should be safe.

If anyone knows a way to do this without eval I would love to know as I am not a fan of using eval.

I would be more worried about the use of `eval();` – RiggsFolly Sep 08 '15 at 11:27 — RiggsFolly, Sep 08 '15 at 11:27
@Epodax Do you see any SQL in there? – Jonnix Sep 08 '15 at 11:27 — Jonnix, Sep 08 '15 at 11:27

Elon Than · Accepted Answer · 2015-09-08T12:09:00.040

3

You shouldn't use eval for that.

Instead simply call you function like that

$functionName($fields);

You can also use one of this functions if they fits your needs better: call_user_func() or call_user_func_array()

edited Sep 08 '15 at 12:09

answered Sep 08 '15 at 11:28

Elon Than

9,603
4
27
37

My sentiments exactly, you beat me to it by seconds! – RiggsFolly Sep 08 '15 at 11:29
thanks. That is a much better solution and I wouldn't have ever thought of it myself. – Matthew Cornelisse Sep 08 '15 at 11:44
1

You can also use the [`call_user_func`](http://php.net/manual/en/function.call-user-func.php) function. – Kevin Nagurski Sep 08 '15 at 11:54

Is this php function safe

1 Answers1