Search code examples
phpmathevalequation

Instead of using eval() to convert a string to a php math equation?

So in the eval() documentation someone quoted:

If eval() is the answer, you're almost certainly asking the wrong question. -- Rasmus Lerdorf, BDFL of PHP

So I don't know how I should ask the question. But what I want is the possibility to:

  1. From a form field put an equation with either php variables ($var['name']) or some kind of replacement words that turns in to variables later for the equation.

  2. Save this equation above to the database.

  3. Be able from a php code to run that equation later.

Note: There will only be a few administrators for the site that will be able/have permission to create and save these equations to the database.

But anyway, so I shouldn't use eval(). What should I use instead? Or how should the question been asked?

Solution

  • If possible, it would be best to avoid using eval with user input for any reason. For example, if there's bug or vulnerability that allows access to an admin account (minor things, like XSS, etc), they can now execute code on your server.

    As mentioned above, a better choice would be using a math parser.

    I've had good experience with hoa/math, which support variables, custom functions, constants and more.