Dynamic Code Execution (ARCH7131)

Key php.security.dynamic-code-execution · Severity critical · Category security · CWE CWE-95

Running a string as code at runtime via eval() is the broadest remote-code-execution primitive. If the input comes from an untrusted source, an attacker can execute arbitrary PHP.

Incorrect

<?php
$op = $_GET['op']; // e.g. "1+1" or malicious code
eval("\$result = $op;");
echo $result;

Correct

<?php
$allowed = ['add' => fn($a, $b) => $a + $b, 'mul' => fn($a, $b) => $a * $b];
$op = $_GET['op'] ?? '';
$result = isset($allowed[$op]) ? $allowed[$op]((int)$_GET['a'], (int)$_GET['b']) : null;

Fix

Avoid eval; replace it with allowlisted operations, parsers, or explicit mapping tables.