PHP eval 与 AJAX 一起使用时生成 500 错误？

Question

我正在使用一个系统，其中所有 PHP 代码都存储在数据库中，以允许动态更改。现在，代码本身在页面上显示时工作得很好，但是当使用 AJAX 调用相同的代码时，它会返回错误 500。我已经尝试启用 display_errors，没有骰子，这一切都归结为 eval 语句，如果它如果不是脚本运行正常，我会收到 500 错误吗？

<?php
global $objPDO;

$objSnippet = $_REQUEST["snippetname"];
    $objVariables = $_REQUEST["snippetvariables"];
    //var_dump($objPDO);
    if ($objSnippet == "XHubDiscussion") {
        $objPDOStatement = $objPDO->prepare("SELECT snippet FROM modx_site_snippets WHERE name = :name LIMIT 1");
        $objPDOStatement->bindParam(":name", $objSnippet, PDO::PARAM_STR);
        if ($objPDOStatement->execute()) {
            $arrSnippet = $objPDOStatement->fetch(PDO::FETCH_ASSOC);
            extract($objVariables);
            //var_dump($arrSnippet);
            if (FALSE === eval($arrSnippet["snippet"])) {
                var_dump("dis also be ronk");
            }
        } else {
            var_dump("Ronk!");
        }
    }
?>

是的，我已经三重检查了其他所有内容，如果评估被注释掉，它的 react 完全正常。执行的代码:

<?php
require_once($_SERVER["DOCUMENT_ROOT"] . "/assets/snippets/xhub/xhub.snippet.php"); 

    global $arrXHubUserCollection;
    $objXHubS = new xHub\security;
    $intPageID = $modx->documentIdentifier;

    if (isset($intXHubPageID)) {
        $intPageID = (int)$intXHubPageID;
    }

    $arrXHubThread = $objXHubS->DiscussionGetThreads(array($intPageID));
    $arrMessageFetch = array((int)$arrXHubThread[0]["id"]);
    if (isset($intXHubPosttime)) {
        $arrMessageFetch[] = (int)$intXHubPosttime;
    }
    $arrXHubMessages = $objXHubS->DiscussionGetMessages($arrMessageFetch);
    $arrXHubUserGroupRelation = $objXHubS->DashboardMessageControl("UserGetGroupRelationship", array());

    $strPageViewer = '<div class="clear XHubPageViewer" style="padding:10px;"></div>';
    if (!isset($intXHubPosttime)) {
        echo XHubTraverseMessages($arrXHubThread, false);
        echo $strPageViewer;
        echo '<div id="XHubConversation">';
    }
    echo XHubTraverseMessages($arrXHubMessages, true);
    if (!isset($intXHubPosttime)) {
        echo '</div>';
        echo $strPageViewer;
        if (is_array($arrXHubUserGroupRelation)) {
            echo '<div class="EPcomment XHubEditField" style="position:inline;z-index:1000;display:block;border-radius:10px;border:1px solid #C7D7D3;background-color:#DEEBE8;margin:0px;padding:0px;"> 
                <div> 
                    <a onclick="XHubMessageEditor(this.parentNode.parentNode);" href="javascript:;" class="ButtonYellowSmall">Bearbeiten!</a>
                </div> 
                <div> 
                    <textarea style="width:97%;"></textarea> 
                </div> 
            </div>';
        }
    }

    function XHubTraverseMessages ($arrMessages, $blnXHubComment) {
        global $arrXHubUserCollection, $objXHubS;
        $strMessageAssembly = "";
        foreach ($arrMessages as $arrMessage) {
            $intXHubUserID = (int)$arrMessage["postid"];
            if (!isset($arrXHubUserCollection[$intXHubUserID])) {
                $arrXHubUser = $objXHubS->DashboardRetrieve(array($intXHubUserID));
                $arrXHubUser["username"][0] = $objXHubS->UserGetNameFromID($intXHubUserID);
                $arrXHubUser["userid"][0] = $intXHubUserID;
                $arrXHubUserCollection[$intXHubUserID] = $arrXHubUser;
            }
            $strMessageAssembly .= XHubCreateMessageField($arrMessage, $arrXHubUserCollection[$intXHubUserID], $blnXHubComment);
        }
        return $strMessageAssembly;
    }
    function XHubCreateMessageField ($arrMessage, $arrUser, $blnXHubComment) {
        $strXHubDebatArrow = '<div class="DebatArrow">&nbsp;</div>';
        $strXHubCommentArrow = '<div class="EPcommentArrow">&nbsp;</div>';
        $strXHubThreadBox = '<div class="BoxGreen width500 right Debatbox MessageField">';
        $strXHubCommentBox = '<div class="EPcomment BoxGray MessageField"><p class="lefttop">Antwort</p>';

        $strXHubMessageContainer = '<div class="clear' . ($blnXHubComment ? " XHubMessages" : " XHubInitThread") . '" id="' . $arrMessage["id"] . ($blnXHubComment ? "" : "D") . '">';
        $strXHubMessage = ($blnXHubComment ? $strXHubCommentBox : $strXHubThreadBox) . 
                '<div class="XHubPostTime" style="display:none">' . $arrMessage["posttime"] . '</div>' . 
                '<p class="righttop">' . date("d-m-Y", $arrMessage["posttime"]) . ' um ' . date("H:i", $arrMessage["posttime"]) . ' Uhr</p>' . 
                '<p class="message">' . $arrMessage["message"] . '</p>'
                . ($blnXHubComment ? $strXHubCommentArrow : $strXHubDebatArrow ) .
                '</div>';
        $strXHubUser = '
            <div class="epUser">
                <p class="username"><a href="expertenpanel/benutzer/' . $arrUser["username"][0] . '" target="_blank">' . $arrUser["username"][0] . '</a></p>
                <img class="profilbild" src="' . $arrUser["imglink"][0] . '" />
                [[getExpertenInfo? &userID=`' . $arrUser["userid"][0] . '` &type=`logo`]]
                <p class="userinfo">
                    <span class="status">[[getExpertenInfo? &userID=`' . $arrUser["userid"][0] . '` &type=`status`]]</span>
                    [[getExpertenInfo? &userID=`' . $arrUser["userid"][0] . '` &type=`showPunkte`]]
                </p>
            </div>
        ';
        $strXHubMessageContainer .= ($blnXHubComment ? $strXHubMessage . $strXHubUser : $strXHubUser . $strXHubMessage);
        $strXHubMessageContainer .= '</div>';
        return $strXHubMessageContainer;
    }
?>

Answer 1

这是一个老问题，但希望它对某人有所帮助。
所有需要评估的代码都必须转义并引用，如下所示:

@eval("\$varA = \"$varB\";");

如果像下面这样，它就会失败:

@eval("\$varA = $varB;");

正如 PHP.net 所说，使用“eval”是危险的，所以除非确实需要，否则请确保不要使用它。