usage of Eval

[carol1988]

hi, I was making an extension and one of my modules failed to load, and stumbled on this code in functions_module.php

Code: Select all

// @codingStandardsIgnoreStart eval('$is_auth = (int) (' . eval($module_auth); . ');'); // @codingStandardsIgnoreEnd return $is_auth;

but my point is, eval usage should be avoided, no ?

[DavidIQ]

Maybe for new code and that depends. That file is several versions old dating back to 3.0. The modules system is something that will be rewritten in the future so that might go away at that point if it's found to not be needed or can be done some other way.

[JoshyPHP]

eval usage should be avoided, no ?

In practice it goes like this:

A: eval() should be avoided()
B: Why?
A: Because it's bad.
B: Why?
A: It's not safe.
B: Why?
A: It can be used to <whatever>
B: How?
A: I don't know.

If you're interested, here's what you should do: find out how eval() is being used, how it could be abused and how it could be replaced.