eval
Evaluates a string as PHP code in the current variable scope and returns its result.
eval(string $code): mixed- Added in PHP 4.0
Parameters
| Parameter | Type | Description |
|---|---|---|
$code | string | Valid PHP code without the opening and closing tags. Every statement must end with a semicolon, exactly as in a normal file. |
Return value
mixednull unless the evaluated code executes a return statement, in which case the returned value is passed back.
Errors
Throws ParseError if the code cannot be parsed. Runtime errors inside the evaluated code behave exactly as they would in a normal file, including fatal errors that stop the script.
Changelog
- PHP 7.0.0A parse error in the evaluated code throws a ParseError instead of returning false and continuing execution.
eval compiles and runs a string as PHP source, sharing the variable scope of the line that called it. Variables it creates or changes remain visible afterwards, and functions or classes it defines land in the global namespace.
Read this first
Passing any value that came from a user, a request, a database row or a file into eval is remote code execution. There is no escaping function that makes untrusted input safe here. If you are tempted to reach for eval to look up a dynamic name or call a dynamic function, use variable variables, $class::$method(), call_user_func() or a closure instead — all faster and all safe.
Legitimate uses
Template compilers, rule engines and test tooling do use it, usually on strings they generated themselves. Even then, include of a generated file is normally better because the opcode cache can store the result, while eval'd code is recompiled every single call.
What trips people up
The string must not contain <?php, and imported namespaces from the calling file are not available inside — write fully qualified names.
Example
When to use it
- Running a small arithmetic or boolean expression from a generated rule string in a build tool.
- Compiling a template into PHP source and executing it during a test.
- Prototyping a snippet in a REPL-style debugging helper.
Frequently asked questions
Is eval safe to use in PHP?
Only on strings your own code generated. Any user-controlled input reaching eval() is a remote code execution vulnerability, and no amount of escaping fixes that.
How do I get a value back out of eval?
Use a return statement inside the evaluated string: $x = eval('return 1 + 1;'). Without a return the call yields null, though variables it assigned are still visible afterwards.
Why does eval say my class does not exist?
eval() does not see the use statements of the calling file. Write the fully qualified class name, for example \\App\\Service, inside the evaluated string.
More examples
Scope is shared with the caller
The output is 2 followed by the new string: eval() modified $counter in the function's scope and left $extra behind, proving the evaluated code is not sandboxed in its own scope.
<?php
function demo(): void {
$counter = 1;
eval('$counter++; $extra = "created inside eval";');
echo $counter, "\n";
echo $extra, "\n";
}
demo();Prefer a safe alternative
All three lines print DYNAMIC CALL, showing that variable functions and call_user_func() do the same job as eval() here without compiling a string or opening an injection hole.
<?php
$fn = 'strtoupper';
$arg = 'dynamic call';
echo eval("return $fn('$arg');"), "\n";
echo $fn($arg), "\n";
echo call_user_func($fn, $arg), "\n";
Discussion