TaintedEval

This is a security issue, reported by security analysis: it flags a potential vulnerability.

Emitted when user-controlled input can be passed into an eval call.

Risk

eval runs a string as PHP code, so user input that reaches it is remote code execution.

Passing untrusted user input to eval calls is dangerous, as it allows arbitrary data to be executed on your server.

<?php

$name = $_GET["name"];

evalCode($name);

function evalCode(string $name) {
    eval($name);
}

Mitigations

  • Don't use eval; use data formats (JSON) or an allowlist of operations instead.
  • If it cannot be avoided, never put user input in the evaluated string.

Further resources