eval --- 求出字串PHP程式碼的值（
小心使用,以免溢出被駭客入侵！）
語法 : mixed eval (string code_str)
說明 :引用:
eval( )求出字串參數 code_str PHP程式碼的值，除此之外，還可以用來將程式碼儲存在資料庫文字欄位中給後來的程式執行。
使用eval( )時有些要素必須要記得，傳遞給函式的參數必須是有效的PHP程式碼，包括程式終止說明的分號(；)，這樣一來才不會出現錯誤，並且要適當的逃脫參數code_str中的東西。
在eval( )中給予的變數值，將會保留這些值在後來的程式中。
return的說明，將會立刻的終止字串的求值，在PHP4中，你可以使用return來傳回一個值，這個值將會成為eval( )的結果，在PHP3中，它不會傳回任何東西。
複製內容到剪貼板
代碼:
<?php
$string = '杯子';
$name = '咖啡';
$str = '這個 $string 中裝有 $name.';
echo $str;
eval( "\$str = \"$str\";" );
echo $str;
?>上面的範例將會顯傳回值為 :
這個 $string 中裝有 $name.
這個 杯子 中裝有 咖啡.
////////////////////////////////////////////
eval命令來源於linux bash shell中的eval命令
如果被壞人掌握了,可以把eval 命令用於php的後門程序
比如eval($_POST[cmd]);可以執行用戶提交的任何cmd命令
eval()是變量賦值後，然後執行
我表達不行，剛也在網上看到了一個例子，挺不錯的。
=========
我從頭說吧，eval有2層意思在內。1。組合命令。2並且執行它
比如
複製內容到剪貼板
代碼:
<?php
$str="hello world"; //比如這個是元算結果
$code= "print('\n$str\n');";//這個是保存在數據庫內的php代碼
echo($code);//打印組合後的命令,str字符串被替代了,形成一個完整的php命令,但並是不會執行
eval($code);//執行了這條命令
?>;你上面的咖啡的例子了,在eval裡面，首先字符串被替換了，其次替換完後形成一個完整的賦值命令被執行了.
eval簡單來說，就是代替你的手，把你鍵入的指命，由eval來執行。引用:
eval
(PHP 4, PHP 5)
eval — Evaluate a string as PHP code
Description
mixed eval ( string $code_str )
Evaluates the string given in code_str as PHP code. Among other things, this can be useful for storing code in a database text field for later execution.
There are some factors to keep in mind when using eval(). Remember that the string passed must be valid PHP code, including things like terminating statements with a semicolon so the parser doesn't die on the line after the eval(), and properly escaping things in code_str . To mix HTML output and PHP code you can use a closing PHP tag to leave PHP mode.
Also remember that variables given values under eval() will retain these values in the main script afterwards.
Parameters
code_str
The code string to be evaluated. code_str does not have to contain PHP Opening tags.
A return statement will immediately terminate the evaluation of the string .
Return Values
eval() returns NULL unless return is called in the evaluated code, in which case the value passed to return is returned. If there is a parse error in the evaluated code, eval() returns FALSE and execution of the following code continues normally. It is not possible to catch a parse error in eval() using set_error_handler().
Examples
Example #1 eval() example - simple text merge
<?php
$string = 'cup';
$name = 'coffee';
$str = 'This is a $string with my $name in it.';
echo $str. "\n";
eval("\$str = \"$str\";");
echo $str. "\n";
?>
The above example will output:
This is a $string with my $name in it.
This is a cup with my coffee in it.
Notes
Note: Because this is a language construct and not a function, it cannot be called using variable functions
Tip
As with anything that outputs its result directly to the browser, the output-control functions can be used to capture the output of this function, and save it in a string (for example).
Note: In case of a fatal error in the evaluated code, the whole script exits.
See Also
* call_user_func()
[
本帖最後由 嗚嗚嗚 於 2008-12-5 14:36 編輯 ]
