PHP assert code injection

Question

Not sure if in this case if it is possible to inject malicious code in $entityId and if it will be processed by php.

$entityId = $_GET["name"];

public function getMetaData($entityId) {
   assert('is_string($entityId)');
}

Note that using string as the assertion is deprecated since PHP 7.2.

PHP assert

Answer 1

The assert function will be called with one static parameter, the string is_string($entityId).

Thanks to the usage of single quotes, $entityId won't be interpolated, so an attacker won't be able to execute any PHP code.