PHP eval and capturing errors (as much as possible)

Question

Disclaimer; I'm fully aware of the pitfalls and "evils" of eval, including but not limited to: performance issues, security, portability etc.

The problem

Reading the PHP manual on eval...

eval() returns NULL unless return is called in the evaluated code, in which case the value passed to return is returned. If there is a parse error in the evaluated code, eval() returns FALSE and execution of the following code continues normally. It is not possible to catch a parse error in eval() using set_error_handler().

In short, no error capture except returning false which is very helpful, but I'm sur eI could do way better!

The reason

A part of the site's functionality I'm working on relies on executing expressions. I'd like not to pass through the path of sandbox or execution modules, so I've ended using eval. Before you shout "what if the client turned bad?!" know that the client is pretty much trusted; he wouldn't want to break his own site, and anyone getting access to this functionality pretty much owns the server, regardless of eval.

The client knows about expressions like in Excel, and it isn't a problem explaining the little differences, however, having some form of warning is pretty much standard functionality.

This is what I have so far:

define('CR',chr(13));
define('LF',chr(10));

function test($cond=''){
    $cond=trim($cond);
    if($cond=='')return 'Success (condition was empty).'; $result=false;
    $cond='$result = '.str_replace(array(CR,LF),' ',$cond).';';
    try {
        $success=eval($cond);
        if($success===false)return 'Error: could not run expression.';
        return 'Success (condition return '.($result?'true':'false').').';
    }catch(Exception $e){
        return 'Error: exception '.get_class($e).', '.$e->getMessage().'.';
    }
}

Notes

The function returns a message string in any event
The code expression should be a single-line piece of PHP, without PHP tags and without an ending semicolon
New lines are converted to spaces
A variable is added to contain the result (expression should return either true or false, and in order not to conflict with eval's return, a temp variable is used.)

So, what would you add to further aide the user? Is there any further parsing functions which might better pinpoint possible errors/issues?

Chris.

if you could provide more feedback on what "expressions" you will use, maybe we can help more. I could think of some nice token_get_all stuff to validate the user input ;) — NikiC
– NikiC, Commented Jul 11, 2010 at 17:32
Normal PHP code? I plan to allow full access to PHP, with the possible exception of defining functions and classes, which isn't needed. — Christian
– Christian, Commented Jul 11, 2010 at 17:37
@Sz. that being said, I'd recommend using symfony/expression-language nowadays (it was not available back in '10). — Christian
– Christian, Commented Oct 2, 2018 at 10:38

NikiC · Accepted Answer · 2018-10-30 22:33:34Z

36

Since PHP 7 eval() will generate a ParseError exception for syntax errors:

try {
    $result = eval($code);
} catch (ParseError $e) {
    // Report error somehow
}

In PHP 5 eval() will generate a parse error, which is special-cased to not abort execution (as parse errors would usually do). However, it also cannot be caught through an error handler. A possibility is to catch the printed error message, assuming that display_errors=1:

ob_start();
$result = eval($code);
if ('' !== $error = ob_get_clean()) {
    // Report error somehow
}

edited Oct 30, 2018 at 22:33

answered Jul 11, 2010 at 17:25

NikiC

102k39 gold badges194 silver badges226 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

Christian Over a year ago

Yes, I did define them, sorry for not mentioning. Fixed above code. As to exceptions, I'm pretty sure it doesn't neither, however, this code might fail in the future after perhaps adding exceptions to it, so it doesn't hurt handling them anyway.

hakre Over a year ago

I was not able to find check_syntax.

user9645 Over a year ago

php_check_syntax was removed in 5.0.5, they expect you to do something like exec("echo '<?php $code' | /usr/local/bin/php -l 2>/dev/null", $out, $ret); which is so much more convenient.

François Over a year ago

!== operator has higher precedence than =. You need to add parentheses: ('' !== ($error = ob_get_clean()))

NikiC Over a year ago

@François Not if the assignment is on the RHS. That's why a Yoda condition is used here.

|

Franz Holzinger · Accepted Answer · 2016-11-04 18:18:49Z

I've found a good alternative/answer to my question.

First of, let me start by saying that nikic's suggestion works when I set error_reporting(E_ALL); notices are shown in PHP output, and thanks to OB, they can be captured.

Next, I've found this very useful code:

/**
 * Check the syntax of some PHP code.
 * @param string $code PHP code to check.
 * @return boolean|array If false, then check was successful, otherwise an array(message,line) of errors is returned.
 */
function php_syntax_error($code){
    if(!defined("CR"))
        define("CR","\r");
    if(!defined("LF"))
        define("LF","\n") ;
    if(!defined("CRLF"))
        define("CRLF","\r\n") ;
    $braces=0;
    $inString=0;
    foreach (token_get_all('<?php ' . $code) as $token) {
        if (is_array($token)) {
            switch ($token[0]) {
                case T_CURLY_OPEN:
                case T_DOLLAR_OPEN_CURLY_BRACES:
                case T_START_HEREDOC: ++$inString; break;
                case T_END_HEREDOC:   --$inString; break;
            }
        } else if ($inString & 1) {
            switch ($token) {
                case '`': case '\'':
                case '"': --$inString; break;
            }
        } else {
            switch ($token) {
                case '`': case '\'':
                case '"': ++$inString; break;
                case '{': ++$braces; break;
                case '}':
                    if ($inString) {
                        --$inString;
                    } else {
                        --$braces;
                        if ($braces < 0) break 2;
                    }
                    break;
            }
        }
    }
    $inString = @ini_set('log_errors', false);
    $token = @ini_set('display_errors', true);
    ob_start();
    $code = substr($code, strlen('<?php '));
    $braces || $code = "if(0){{$code}\n}";
    if (eval($code) === false) {
        if ($braces) {
            $braces = PHP_INT_MAX;
        } else {
            false !== strpos($code,CR) && $code = strtr(str_replace(CRLF,LF,$code),CR,LF);
            $braces = substr_count($code,LF);
        }
        $code = ob_get_clean();
        $code = strip_tags($code);
        if (preg_match("'syntax error, (.+) in .+ on line (\d+)$'s", $code, $code)) {
            $code[2] = (int) $code[2];
            $code = $code[2] <= $braces
                ? array($code[1], $code[2])
                : array('unexpected $end' . substr($code[1], 14), $braces);
        } else $code = array('syntax error', 0);
    } else {
        ob_end_clean();
        $code = false;
    }
    @ini_set('display_errors', $token);
    @ini_set('log_errors', $inString);
    return $code;
}

Seems it easily does exactly what I need (yay)!

Wow, this looks nice. And again I've learned something new: break can have an argument! I will later cast a look at this code to really understand what it does. Only one note: If there are heavy parse errors in the code, token_get_all can output errors by itself, e.g. if you are using `\` in the source (in PHP <5.3).
It is very nice. Sadly it still does not - can not - provide protection against wrong function calls, e.g. simple spelling mistakes in function names. PHP should really think about catching fatal errors in eval().

Robin van Baalen · Accepted Answer · 2016-09-08 03:21:40Z

11

How to test for parse errors inside eval():

$result = @eval($evalcode . "; return true;");

If $result == false, $evalcode has a parse error and does not execute the 'return true' part. Obviously $evalcode must not return itself something, but with this trick you can test for parse errors in expressions effectively...

edited Sep 8, 2016 at 3:21

Robin van Baalen

3,6712 gold badges24 silver badges36 bronze badges

answered Nov 5, 2015 at 18:45

Davide Moretti

1272 silver badges3 bronze badges

3 Comments

itoctopus Over a year ago

Very intelligent idea! I haven't tested it yet but I will.

DUzun Over a year ago

You can't catch Parse Errors in eval'd code! It would just stop execution of your script.

rgbflawed Over a year ago

This worked great for me, even with my eval() returning a value. I have $value=eval("return ".$evalcode."; return false;"); and then if ($value===false) echo ("Error with: ".$evalcode); Of course this means that evalcode can never return false in a normal circumstance. But that fits my use.

Majkel · Accepted Answer · 2021-08-18 11:07:32Z

7

I think that best solution is

try {
    eval(/* ... */);
} catch (Throwable $t) {
    //...
}

It catches every error and exception, including Call to undefined function etc

answered Aug 18, 2021 at 11:07

Majkel

2114 silver badges5 bronze badges

3 Comments

smolo Over a year ago

This doesn't seem to catch Parse Errors.

Zagorax Nov 25, 2024 at 13:19

This solution works for me and catches ParseError as well. I am using PHP 8.2.

Watts Epherson Mar 10 at 22:46

I can confirm this catches "uncaught error" which was a syntax error in my evaluated code. Using 8.1. Hmm, can you do a try within a try within a try?... I'll go away and find out - probably can't! :))

Sz. · Accepted Answer · 2018-10-30 22:27:10Z

3

Good news: As of PHP 7, eval() now* throws a ParseError exception if the evaluated code is invalid:

try
{
    eval("Oops :-o");
}
catch (ParseError $err)
{
    echo "YAY! ERROR CAPTURED: $err";
}

* Well, for quite a while then... ;)

edited Oct 30, 2018 at 22:27

answered Oct 30, 2018 at 22:20

Sz.

3,7431 gold badge34 silver badges47 bronze badges

Comments

barbushin · Accepted Answer · 2013-08-10 07:24:39Z

2

You can also try something like this:

$filePath = '/tmp/tmp_eval'.mt_rand();
file_put_contents($filePath, $evalCode);
register_shutdown_function('unlink', $filePath);
require($filePath);

So any errors in $evalCode will be handled by errors handler.

answered Aug 10, 2013 at 7:24

barbushin

5,2825 gold badges40 silver badges44 bronze badges

Collectives™ on Stack Overflow

PHP eval and capturing errors (as much as possible)

6 Answers 6

7 Comments

2 Comments

3 Comments

3 Comments

Comments

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

6 Answers 6

7 Comments

2 Comments

3 Comments

3 Comments

Comments

Comments

Linked

Related