create_function() is not your friend

From:

http://blog.libssh2.org/index.php?/archives/60-create_function-is-not-your-friend.html



create_function 到底作了些什么呢?

function create_function($args, $code)
{
 static $id = 0;
 eval("function __lambda_func($args) { $code }");
 while (!runkit_function_rename('__lambda_func', "\0lambda_" . (++$id)));
 return "\0lambda_$id";
}

I'll let you contemplate on that awhile....You should be noticing the following sets of problems:

  • Prone to critical abuse by user-supplied code
  • Skips opcode cache optimizations

 

You should also be thinking about the practical issues with it:

  • Code lives inside quoted strings which means awkward escaping of embedded quotes
  • Encourages not using comments (evil)
  • 100% blind to reflection or PHPDoc style documentation generation
  • I'm sure you can come up with a couple more...

This article is posted by on , link is .

Leave a reply