Zennoxa Shield
Rules / PHP
SHIELD-PHP-005

Code injection via eval or assert on variables

criticalPHPCWE-95CVSS 9.8

What it detects

eval, assert, or create_function receives a variable allowing arbitrary PHP code execution.

How to fix

Never pass dynamic input to eval/assert; refactor to avoid dynamic code evaluation.

Vulnerable — Shield flags thiscalc.php
<?php
// Spreadsheet-style formula endpoint — vulnerable to PHP code injection
$result = eval("return " . $_POST['formula'] . ";");
echo '<td>' . htmlspecialchars((string) $result, ENT_QUOTES) . '</td>';
Fixed — scans cleancalc.php
<?php
// Validated inputs + an allowlisted operation instead of eval()
$op = filter_var($_POST['op'] ?? '', FILTER_VALIDATE_REGEXP, ['options' => ['regexp' => '/^(add|mul)$/']]);
$a = filter_var($_POST['a'] ?? '', FILTER_VALIDATE_FLOAT);
$b = filter_var($_POST['b'] ?? '', FILTER_VALIDATE_FLOAT);
if ($op === false || $a === false || $b === false) {
    exit('Invalid request');
}
$result = $op === 'add' ? $a + $b : $a * $b;
echo json_encode(['result' => $result]);

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PHP-005, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PHP-005: Code injection via eval or assert on variables — Zennoxa Shield