PHP filter_input() not protecting from eval()

Question

I was updating some PHP code following the advice of not using $_GET and $_POST anymore but instead to switch to the safer filter_input() functions.

I was thinking that function would save me in this stupid case:

<?php 

eval($_GET["var"]);

?>

which when called as localhost/test.php?var=phpinfo(); spits the whole PHP info page. So I changed it to:

<?php 

eval(filter_input(INPUT_GET, "var", FILTER_SANITIZE_STRING));

?>

However it seems that the above is still vulnerable to the same attack. Which should be the correct way of securing the eval() in the case above?

Answer 1

filter_input is designed to filter out things that may cause issues with HTML output: from the PHP manual "Strip tags, optionally strip or encode special characters."

phpinfo() doesn't include any special characters, or tags, so is passed through exactly as provided, then eval executes it. In fact, this is the case for a lot of PHP code - you're using a filter designed for a different purpose.

As @SteffanUllrich says, you can't secure eval - it executes PHP, which is almost exactly what you want to prevent. Your best option at this point is to rewrite your code to avoid using the eval function.

Ways to do this could include passing an indirect reference to a function (e.g. if you get a parameter of 1, use a switch block to execute function_one()), or just hardcoding each PHP file to do a specific thing. If you provide any way for an end user to provide PHP code which is executed, you're likely to have problems.

Answer 2

Which should be the correct way of securing the eval() in the case above?

There is no way to secure input to eval. Just don't use eval on any user-generated data.