PHP on EZ-Pages Safe or NOT?

29 May 2008, 9:37 AM

Zen Follower

Join Date:: Feb 2006
Posts:: 125
Plugin Contributions:: 0

PHP on EZ-Pages Safe or NOT?

I want to use PHP code on some EZ-Pages. I found the code below on the forum that will enable PHP to be written to the database for the EZ-Pages:

<div><?php eval(stripslashes('?>' . $var_pageDetails->fields['pages_html_text'])); ?></div>

Does anyone know if this method is safe to use or is it a potential security hole?

Are there other methods that are better for this?

Picci

http://HarryNile.com

1 Jun 2008, 10:38 AM

picci

Zen Follower

Join Date:: Feb 2006
Posts:: 125
Plugin Contributions:: 0

Re: PHP on EZ-Pages Safe or NOT?

I googled around and found the following links on eval() and security:

http://www.php.net/eval

http://en.wikipedia.org/wiki/Eval

From what I gather the biggest risk is to allow unknown user generated content to be run through an eval(). They could run their own PHP scripts. For example if you had a form where an unknown user can input data, and that input data gets run through an eval(), the user could run their own PHP code through it.

Picci

http://HarryNile.com