phanalist

E0059: Dynamic eval or assert

In plain English: eval() runs a string as PHP code. A string-based assert() can do the same. If any part of the string comes from a request, an attacker may be able to run code.

Why it matters: Code built at runtime is hard to validate and can turn data into executable code.

Bad

return eval($code);

assert('$value > 0');

Good

$callback = $handlers[$name] ?? null;

if ($callback !== null) {
    return $callback();
}

assert($value > 0);

What the rule checks

• Any eval() call
• assert() with a string literal or string concatenation

When it does not report

• assert() receives a boolean expression.
• The code uses a callback, dispatch table, or parser instead of eval().

How to fix

• Replace eval() with a parser, a dispatch table, or an explicit callback.
• Use a boolean expression in assert().
• Never build executable code from request data.

Model limits

• String expressions stored in variables before being passed to assert() are not traced.
• create_function() and similar legacy helpers are not checked.
• Boolean assertions are accepted.

Configuration

E0059 has no configuration options and is enabled by default.

This site is open source. Improve this page.