I was updating some PHP code following the advice of not using
$_POST anymore but instead to switch to the safer
I was thinking that function would save me in this stupid case:
<?php eval($_GET["var"]); ?>
which when called as
localhost/test.php?var=phpinfo(); spits the whole PHP info page. So I changed it to:
<?php eval(filter_input(INPUT_GET, "var", FILTER_SANITIZE_STRING)); ?>
However it seems that the above is still vulnerable to the same attack.
Which should be the correct way of securing the
eval() in the case above?