Path: csiph.com!usenet.pasdenom.info!aioe.org!news.swapon.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: Arno Welzel Newsgroups: comp.lang.php Subject: Re: Nested PHP Date: Mon, 17 Mar 2014 15:26:52 +0100 Lines: 36 Message-ID: <5327062C.6010706@arnowelzel.de> References: <1lgvceg.n1ow4ilfgsk0N%adrian@poppyrecords.invalid.invalid> <5313461D.70508@arnowelzel.de> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Trace: individual.net 8Iw+ezsghWphBHQlrZ7UkQPPCOD60eqtP4VpxO6306rldwdzzt Cancel-Lock: sha1:WVGL6seDolnOe1n3X2GlRmQJdWY= User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.3.0 In-Reply-To: Xref: csiph.com comp.lang.php:13198 Am 03.03.2014 12:38, schrieb The Natural Philosopher: > On 02/03/14 14:54, Arno Welzel wrote: >> Adrian Tuddenham, 2014-02-10 21:24: >> [About eval()] >> I recommend to think about what you want to solve and if it is really >> neccessary to create "dyanamic" PHP on the fly. >> > Nice thing about evalled code is that you can stick it in a database.. You call it "nice" to put *code* in a database? I would call it an ugly hack. I know, some products like vBulletin do this in production environments - they put all their plugins and some other stuff in the database. But this does not mean this is "nice" nor even something you want. Even WordPress does not try to put code into the database ;-) This is only a hack for situations where a plugin installer in the administrative backend may not be able to write the files. Some may this even call more "secure" since you can set the folder permissions more restrictive. Some may call this more "comfortable" since you don't need to give the web server permissions to write to the document root. But in the end - it doesn't matter if an attacker is able to overwrite files or overwrite database content, and securing the database is not as easy as protecting the filesystem. -- Arno Welzel http://arnowelzel.de http://de-rec-fahrrad.de