I want to know that How eval function can be dangerous for any web application's Security?

Below is the code I use to understand when any user input passes to the eval function, then How an attacker can exploit it?


$x = @$_GET['arg'];

eval("\$y = \"$x\";");
echo $x;

  • it's more-or-less the same as allowing .php file uploads from any user.
    – dandavis
    Commented Feb 9, 2018 at 7:26

1 Answer 1


Ok, first imagine that I send this request:


Your eval then looks like this:

$y = "foo";

But if I send this:


This turns your code into this:

$y = ""; echo exec('whoami'); //";

Which executes the "whoami" command on the server and prints the result. The // comments out the end part of your original code so it gets ignored and my code runs successfully.

This is an incredibly trivial remote code execution bug to exploit.

  • 1
    Wow, I just try this after your payload "; echo system('dir'); // And I said "fuck really". Now I got how it can be dangerous. Thanks @Polynomial Commented Feb 8, 2018 at 12:41
  • Yup. You can just run any arbitrary PHP, and thus any arbitrary system commands, via this.
    – Polynomial
    Commented Feb 8, 2018 at 12:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .