Do not use the eval() function in PHP. The eval() function evaluates a string as PHP code, which can lead to serious security risks if the string contains user input or data from an untrusted source. This is because it opens the door to code injection attacks, where an attacker can execute arbitrary PHP code.
To adhere to this rule and avoid potential security vulnerabilities, you should never use eval() in your PHP code. Instead, consider using safer alternatives that don’t evaluate strings as code. For instance, if you want to dynamically call a function based on a string name, you can use the call_user_func() function. Always ensure to sanitize and validate any user input or data from untrusted sources.
Non-Compliant Code Examples
<?php$code="echo 'test'";eval($code);
Compliant Code Examples
<?phpecho'test';
Seamless integrations. Try Datadog Code Analysis
Datadog Code Analysis
Try this rule and analyze your code with Datadog Code Analysis
How to use this rule
1
2
rulesets:- php-security # Rules to enforce PHP security.
Create a static-analysis.datadog.yml with the content above at the root of your repository
Use our free IDE Plugins or add Code Analysis scans to your CI pipelines
