Now don't get me wrong, there are already other questions like this. But I'm looking into more of how an attack could actually be done.

Instance A: A hacker gains access to a web server / hosting. They make changes to files so that instead of the original code, malicious code will run.

Ok, so I think scenario has many obvious problems. Even if a hacker somehow managed to get into a server, why would they use eval() of all things when they have the entire code at their disposal, it would probably make more sense just to run malicious code on the server and modify the existing code anyway.

Instance B: A hacker gains access to an consumer's device, uses a saved password to log into the victim's account and proceeds to execute malicious code.

In this instance, eval() wouldn't make much sense, because they have the account already. Either use the interface (say transferring money from the victim to the hacker), or just execute code in the DevTools?

Instance C: A hacker uploads malicious code to a public forum site (like SQL Injection). When a user opens this site, the tags <script></script> are inserted into the DOM rather than plain text.

Well as a general security measure, shouldn't all code be validated both on the client and on the server to make sure that code isn't being entered? Additionally, it's already a good practice to pass in data as plain text on client pages. This is just to raise the point that validation is important, not that eval() would be used. Because validation before any eval() is always important, so even if they used code as a string passed into eval() instead of inserting the code into the DOM using script tags, the code shouldn't even reach the database because the server should have validation anyway.

So in conclusion, I can't think of a scenario where eval() would be the best play for a hacker, as if they had access to that, I would assume that they would take better methods at their disposal (like modifying source and DevTools) rather than using eval().

  • "Instance C: ....shouldn't all code be validated both on the client..." - you basically say that if every user input would be 100% properly verified then XSS using eval would not work. While true exactly this is the problem, i.e. it is common that user input is not verified, only somehow verified or even verified a lot but still not enough to address all possible cases where and how this user input could will be used. 100% proper validation can be really hard in many cases. Mar 14, 2020 at 9:17
  • I've updated your title because I don't think your previous title was a good fit to your question as written. If you disagree though feel free to revert my change or edit it yourself. Mar 14, 2020 at 12:23

1 Answer 1


The way I understand it, eval is often used because it allows flexibility, to run whatever code the attacker wants. It's part of their "web shell", their way to interact with infected servers. I guess eval is just one of the quickest and most flexible ways to interact with an infected machine and make it execute the attacker's code.

// very simple example: in practice often you will also find
// obfuscation, base64 encoding, compression, POST instead of GET, etc.
$command = $_GET['foobar123'];

// request that will likely execute any PHP code on any server

Other access methods are probably not that flexible. For example, suppose the attacker has admin accounts in several infected CMS's. Only using their admin account, to run their malicious code they would have to install a malicious extension, and each extension should be coded specifically for each CMS type (WordPress, Joomla, Drupal, etc.). So it looks like it's hard to find a quicker and more flexible method than eval (or similar functions like exec, etc.).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .