<?xml version="1.0" encoding="utf-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Using Eval in PHP</title>
	<atom:link href="http://blog.joshuaeichorn.com/archives/2005/08/01/using-eval-in-php/feed/" rel="self" type="application/rss+xml" />
	<link>http://blog.joshuaeichorn.com/archives/2005/08/01/using-eval-in-php/</link>
	<description>The weblog of Joshua Eichorn, AJAX, PHP and Open Source</description>
	<lastBuildDate>Mon, 20 Jun 2011 19:31:33 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.1.4-alpha</generator>
	<item>
		<title>By: Ali</title>
		<link>http://blog.joshuaeichorn.com/archives/2005/08/01/using-eval-in-php/comment-page-1/#comment-766450</link>
		<dc:creator>Ali</dc:creator>
		<pubDate>Wed, 26 May 2010 04:35:07 +0000</pubDate>
		<guid isPermaLink="false">http://blog.joshuaeichorn.com/?p=166#comment-766450</guid>
		<description>I think this this benchmark is not real results.
when you call a page in browser, you will connect to a webserver.
web server opens php (as cgi, fast-cgi, etc...) and then, PHP first open the script, compile it and then parse it.

with timing method that you used, you not calculated these levels but parsing.
when you use eval(), PHP will compile PHP code.

unfortunately, PHP is an slow scripting language and because of this, there are dozen&#039;s of compiler extensions for PHP like APC, ionCube, eAccelerator, Zend, ...

because of this problem, I have writen my own database, webserver and my blog and forums systems with C running on CentOS.
It&#039;s about 25x faster (in average) in my tests. (in some cases, more than 70x)</description>
		<content:encoded><![CDATA[<p>I think this this benchmark is not real results.<br />
when you call a page in browser, you will connect to a webserver.<br />
web server opens php (as cgi, fast-cgi, etc&#8230;) and then, PHP first open the script, compile it and then parse it.</p>
<p>with timing method that you used, you not calculated these levels but parsing.<br />
when you use eval(), PHP will compile PHP code.</p>
<p>unfortunately, PHP is an slow scripting language and because of this, there are dozen&#8217;s of compiler extensions for PHP like APC, ionCube, eAccelerator, Zend, &#8230;</p>
<p>because of this problem, I have writen my own database, webserver and my blog and forums systems with C running on CentOS.<br />
It&#8217;s about 25x faster (in average) in my tests. (in some cases, more than 70x)</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Joshua Eichorn</title>
		<link>http://blog.joshuaeichorn.com/archives/2005/08/01/using-eval-in-php/comment-page-1/#comment-663480</link>
		<dc:creator>Joshua Eichorn</dc:creator>
		<pubDate>Fri, 08 May 2009 22:57:37 +0000</pubDate>
		<guid isPermaLink="false">http://blog.joshuaeichorn.com/?p=166#comment-663480</guid>
		<description>15, i doubt you can make it faster, debug_backtrace is slow</description>
		<content:encoded><![CDATA[<p>15, i doubt you can make it faster, debug_backtrace is slow</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: PHP security &#171; The Struggle</title>
		<link>http://blog.joshuaeichorn.com/archives/2005/08/01/using-eval-in-php/comment-page-1/#comment-661562</link>
		<dc:creator>PHP security &#171; The Struggle</dc:creator>
		<pubDate>Sun, 03 May 2009 11:55:12 +0000</pubDate>
		<guid isPermaLink="false">http://blog.joshuaeichorn.com/?p=166#comment-661562</guid>
		<description>[...] If you have to then make sure you check the content of the string before you use it. Try this for more [...]</description>
		<content:encoded><![CDATA[<p>[...] If you have to then make sure you check the content of the string before you use it. Try this for more [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Erwin Haantjes</title>
		<link>http://blog.joshuaeichorn.com/archives/2005/08/01/using-eval-in-php/comment-page-1/#comment-655969</link>
		<dc:creator>Erwin Haantjes</dc:creator>
		<pubDate>Sun, 12 Apr 2009 01:20:27 +0000</pubDate>
		<guid isPermaLink="false">http://blog.joshuaeichorn.com/?p=166#comment-655969</guid>
		<description>Hello, i have made a class function that makes it easier to deal with constructors and parent functions, it is also using eval to call the parent function. It is called inherited(), see example code below. But the question is, is it real slower? Does have anybody an idea (when speed is an issue) to get better perfomance?

Here it is:
Hi, i wanted to get rid off the parent::methodName(myVar1, myVar2, myVar3 etc.....) construction so i wrote a shortcut to this notation. The only thing you have to do is calling $this-&gt;inherited() (or parent::inherited()) to call the same function with the same parameters in the parent class. It is also possible to specify other parameters if you like (also by reference). You can also use this inside constructors/destructors. It is also possible (without rewriting an existing php4 &#039;base&#039; class and it&#039;s constructors/destructors) to use a php4 class as base class in php5, anyway look at the source code below.

IMPORTANT TO KNOW:
- $this-&gt;raise() is a custom error function, it displays trace info when called
- There are some defines used to display, these are not included in this demo (but doesn&#039;t care)
- TObject is an custom base object that have the inherited() function as described below.  
 
The function (used in base class of all objects):
    public function inherited() 
    {
       // Use DEBUG backtrace to trace caller function
      $bt = debug_backtrace($this);
      $bt = $bt[ 1 ]; // List is in reversed order, 0 reffers to this function so get previous one
      
      if( !@count( $bt ))
      { $this-&gt;raise( ERR_DEBUGTRACE_INFO_INVALID ); }
      
      $sFuncName = $bt[&quot;function&quot;];
      $sClassName = $bt[&quot;class&quot;];
      $sParentClassName = get_parent_class( $sClassName );
       
       // check absurt situations to be sure
      if( empty( $sClassName ) or empty( $sParentClassName ) or $sParentClassName == $sClassName )
      { $this-&gt;raise( str_replace( array( &quot;%s1&quot;, &quot;%s2&quot; ), array( $sFuncName, $sClassName ), ERR_CANNOT_CALL_INHERITED )); } 
      
       // constructor or destructor called (or calls and old fashion way php 4 constructor or destructor)?
      $bIsConstruct   = false;
      if( ( $bIsConstructor = ( $sFuncName == &quot;__construct&quot; )) 
        or ( $bIsDestructor = ( $sFuncName == &quot;__destruct&quot; )) 
         or ( $bIsConstruct = ( $sFuncName == $sClassName )) or ( $sFuncName == &quot;_&quot;.$sClassName ) )
      { 
        // get parent constructor/destructor
        $sFuncName = (( !$bIsConstructor and !$bIsConstruct ) ? &quot;_&quot; : &quot;&quot; ).$sParentClassName;
      	
        $bFunctionExist    = method_exists( $sParentClassName, $sFuncName );
        $bConstructorExist = ( $bIsConstructor or $bIsConstruct ) ? method_exists( $sParentClassName, &quot;__construct&quot; ) : false;
        $bDestructorExist  = ( !$bIsConstructor or !$bIsConstruct ) ? method_exists( $sParentClassName, &quot;__destruct&quot; )  : false;
        
        if( $bConstructorExist or $bDestructorExist )
         { 
         	$sFuncName    = ( $bConstructorExist ) ? &quot;__construct&quot; : &quot;__destruct&quot;; // preffer to call this 
            $bIsConstruct = !$bDestructorExist;
            $bIsConstructor = false;
            $bFunctionExist = true;
         }
      	elseif( $bFunctionExist and !$bIsConstructor and !$bIsDestructor )
      	     { $bFunctionExist = ( $sFuncName != (( !$bIsConstruct ) ? &quot;_&quot; : &quot;&quot; ).$sClassName ); } 
      		   
      	if( !$bFunctionExist )
         { $this-&gt;raise( str_replace( array( &quot;%s1&quot;, &quot;%s2&quot; ), array( $sFuncName, $sParentClassName ), ( $bIsConstruct ) ? ERR_CANNOT_CALL_INHERITED_CONSTRUCTOR : ERR_CANNOT_CALL_INHERITED_DESTRUCTOR )); } 
      }
      else { $bFunctionExist = method_exists( $sParentClassName, $sFuncName ); }      
       
      if( $bFunctionExist )
       { 
       	  // If there are parameters specified, use these
         $args = func_get_args();
         if( ( $iCount = @count( $args ))  0 )
         { 
           for( $i = 0; $i &lt; $iCount; $i++ )
            { $sArgs.=&quot;&amp;$&quot;.&quot;args[$i]&quot;.( $i raise( str_replace( array( &quot;%s1&quot;, &quot;%s2&quot; ), array( $sFuncName, $sParentClassName ), ERR_CANNOT_CALL_INHERITED )); }    
    }

example (DEMO):
class TTest extends TObject
{
public function __construct()
{
  $this-&gt;inherited();
}	

public function __destruct()
{
  print( &quot;destructror called TTest\n&quot; );
  $this-&gt;inherited();
}   


public function test(&amp;$param1)
{
  $param1 = $param1.&quot; world&quot;;
  return $param1.&quot; &quot;.$this-&gt;className;
}
}	

class TTest2 extends TTest
{
public function __construct()
{
  $this-&gt;inherited();
}   

public function __destruct()
{
  print( &quot;destructror called TTest2\n&quot; );
  $this-&gt;inherited();
}   

public function test(&amp;$param1)
{
 return $this-&gt;inherited();
}   
}

class TTest3 extends TTest2
{
public function __construct()
{
  $this-&gt;inherited();
}   

public function test(&amp;$param1)
{
 return $this-&gt;inherited();
}   

public function __destruct()
{
  print( &quot;destructror called TTest3\n&quot; );
  $this-&gt;inherited();
}   

}

$test = new TTest3();
$s = &quot;hello&quot;;
print( &quot;\nOrginal reference string is : $s\n&quot; );
print( &quot;function result is          : &quot;.$test-&gt;test( $s ).&quot;\n&quot; ); 
print( &quot;Modified reference string is: $s\n\n&quot; );


So what do u think?</description>
		<content:encoded><![CDATA[<p>Hello, i have made a class function that makes it easier to deal with constructors and parent functions, it is also using eval to call the parent function. It is called inherited(), see example code below. But the question is, is it real slower? Does have anybody an idea (when speed is an issue) to get better perfomance?</p>
<p>Here it is:<br />
Hi, i wanted to get rid off the parent::methodName(myVar1, myVar2, myVar3 etc&#8230;..) construction so i wrote a shortcut to this notation. The only thing you have to do is calling $this-&gt;inherited() (or parent::inherited()) to call the same function with the same parameters in the parent class. It is also possible to specify other parameters if you like (also by reference). You can also use this inside constructors/destructors. It is also possible (without rewriting an existing php4 &#8216;base&#8217; class and it&#8217;s constructors/destructors) to use a php4 class as base class in php5, anyway look at the source code below.</p>
<p>IMPORTANT TO KNOW:<br />
- $this-&gt;raise() is a custom error function, it displays trace info when called<br />
- There are some defines used to display, these are not included in this demo (but doesn&#8217;t care)<br />
- TObject is an custom base object that have the inherited() function as described below.  </p>
<p>The function (used in base class of all objects):<br />
    public function inherited()<br />
    {<br />
       // Use DEBUG backtrace to trace caller function<br />
      $bt = debug_backtrace($this);<br />
      $bt = $bt[ 1 ]; // List is in reversed order, 0 reffers to this function so get previous one</p>
<p>      if( !@count( $bt ))<br />
      { $this-&gt;raise( ERR_DEBUGTRACE_INFO_INVALID ); }</p>
<p>      $sFuncName = $bt["function"];<br />
      $sClassName = $bt["class"];<br />
      $sParentClassName = get_parent_class( $sClassName );</p>
<p>       // check absurt situations to be sure<br />
      if( empty( $sClassName ) or empty( $sParentClassName ) or $sParentClassName == $sClassName )<br />
      { $this-&gt;raise( str_replace( array( &#8220;%s1&#8243;, &#8220;%s2&#8243; ), array( $sFuncName, $sClassName ), ERR_CANNOT_CALL_INHERITED )); } </p>
<p>       // constructor or destructor called (or calls and old fashion way php 4 constructor or destructor)?<br />
      $bIsConstruct   = false;<br />
      if( ( $bIsConstructor = ( $sFuncName == &#8220;__construct&#8221; ))<br />
        or ( $bIsDestructor = ( $sFuncName == &#8220;__destruct&#8221; ))<br />
         or ( $bIsConstruct = ( $sFuncName == $sClassName )) or ( $sFuncName == &#8220;_&#8221;.$sClassName ) )<br />
      {<br />
        // get parent constructor/destructor<br />
        $sFuncName = (( !$bIsConstructor and !$bIsConstruct ) ? &#8220;_&#8221; : &#8220;&#8221; ).$sParentClassName;</p>
<p>        $bFunctionExist    = method_exists( $sParentClassName, $sFuncName );<br />
        $bConstructorExist = ( $bIsConstructor or $bIsConstruct ) ? method_exists( $sParentClassName, &#8220;__construct&#8221; ) : false;<br />
        $bDestructorExist  = ( !$bIsConstructor or !$bIsConstruct ) ? method_exists( $sParentClassName, &#8220;__destruct&#8221; )  : false;</p>
<p>        if( $bConstructorExist or $bDestructorExist )<br />
         {<br />
         	$sFuncName    = ( $bConstructorExist ) ? &#8220;__construct&#8221; : &#8220;__destruct&#8221;; // preffer to call this<br />
            $bIsConstruct = !$bDestructorExist;<br />
            $bIsConstructor = false;<br />
            $bFunctionExist = true;<br />
         }<br />
      	elseif( $bFunctionExist and !$bIsConstructor and !$bIsDestructor )<br />
      	     { $bFunctionExist = ( $sFuncName != (( !$bIsConstruct ) ? &#8220;_&#8221; : &#8220;&#8221; ).$sClassName ); } </p>
<p>      	if( !$bFunctionExist )<br />
         { $this-&gt;raise( str_replace( array( &#8220;%s1&#8243;, &#8220;%s2&#8243; ), array( $sFuncName, $sParentClassName ), ( $bIsConstruct ) ? ERR_CANNOT_CALL_INHERITED_CONSTRUCTOR : ERR_CANNOT_CALL_INHERITED_DESTRUCTOR )); }<br />
      }<br />
      else { $bFunctionExist = method_exists( $sParentClassName, $sFuncName ); }      </p>
<p>      if( $bFunctionExist )<br />
       {<br />
       	  // If there are parameters specified, use these<br />
         $args = func_get_args();<br />
         if( ( $iCount = @count( $args ))  0 )<br />
         {<br />
           for( $i = 0; $i &lt; $iCount; $i++ )<br />
            { $sArgs.=&#8221;&amp;$&#8221;.&#8221;args[$i]&#8220;.( $i raise( str_replace( array( &#8220;%s1&#8243;, &#8220;%s2&#8243; ), array( $sFuncName, $sParentClassName ), ERR_CANNOT_CALL_INHERITED )); }<br />
    }</p>
<p>example (DEMO):<br />
class TTest extends TObject<br />
{<br />
public function __construct()<br />
{<br />
  $this-&gt;inherited();<br />
}	</p>
<p>public function __destruct()<br />
{<br />
  print( &#8220;destructror called TTest\n&#8221; );<br />
  $this-&gt;inherited();<br />
}   </p>
<p>public function test(&amp;$param1)<br />
{<br />
  $param1 = $param1.&#8221; world&#8221;;<br />
  return $param1.&#8221; &#8220;.$this-&gt;className;<br />
}<br />
}	</p>
<p>class TTest2 extends TTest<br />
{<br />
public function __construct()<br />
{<br />
  $this-&gt;inherited();<br />
}   </p>
<p>public function __destruct()<br />
{<br />
  print( &#8220;destructror called TTest2\n&#8221; );<br />
  $this-&gt;inherited();<br />
}   </p>
<p>public function test(&amp;$param1)<br />
{<br />
 return $this-&gt;inherited();<br />
}<br />
}</p>
<p>class TTest3 extends TTest2<br />
{<br />
public function __construct()<br />
{<br />
  $this-&gt;inherited();<br />
}   </p>
<p>public function test(&amp;$param1)<br />
{<br />
 return $this-&gt;inherited();<br />
}   </p>
<p>public function __destruct()<br />
{<br />
  print( &#8220;destructror called TTest3\n&#8221; );<br />
  $this-&gt;inherited();<br />
}   </p>
<p>}</p>
<p>$test = new TTest3();<br />
$s = &#8220;hello&#8221;;<br />
print( &#8220;\nOrginal reference string is : $s\n&#8221; );<br />
print( &#8220;function result is          : &#8220;.$test-&gt;test( $s ).&#8221;\n&#8221; );<br />
print( &#8220;Modified reference string is: $s\n\n&#8221; );</p>
<p>So what do u think?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: John Kleijn</title>
		<link>http://blog.joshuaeichorn.com/archives/2005/08/01/using-eval-in-php/comment-page-1/#comment-596522</link>
		<dc:creator>John Kleijn</dc:creator>
		<pubDate>Sat, 06 Dec 2008 14:22:36 +0000</pubDate>
		<guid isPermaLink="false">http://blog.joshuaeichorn.com/?p=166#comment-596522</guid>
		<description>This benchmark is useless. You can&#039;t compare the performance of already parsed code with unparsed code. Compare it against &#039;include&#039; and we have something that actually says something other than, &quot;yes, parsing code takes time&quot;.</description>
		<content:encoded><![CDATA[<p>This benchmark is useless. You can&#8217;t compare the performance of already parsed code with unparsed code. Compare it against &#8216;include&#8217; and we have something that actually says something other than, &#8220;yes, parsing code takes time&#8221;.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: sharpskater69</title>
		<link>http://blog.joshuaeichorn.com/archives/2005/08/01/using-eval-in-php/comment-page-1/#comment-498987</link>
		<dc:creator>sharpskater69</dc:creator>
		<pubDate>Thu, 19 Jun 2008 19:24:06 +0000</pubDate>
		<guid isPermaLink="false">http://blog.joshuaeichorn.com/?p=166#comment-498987</guid>
		<description>good. consider using /\W/, much easier in your example. good though.</description>
		<content:encoded><![CDATA[<p>good. consider using /\W/, much easier in your example. good though.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: PHP security &#124; TheStruggle</title>
		<link>http://blog.joshuaeichorn.com/archives/2005/08/01/using-eval-in-php/comment-page-1/#comment-391134</link>
		<dc:creator>PHP security &#124; TheStruggle</dc:creator>
		<pubDate>Fri, 22 Feb 2008 14:22:40 +0000</pubDate>
		<guid isPermaLink="false">http://blog.joshuaeichorn.com/?p=166#comment-391134</guid>
		<description>[...] dangerous. If you have to then make sure you check the content of the string before you use it. Try this for more [...]</description>
		<content:encoded><![CDATA[<p>[...] dangerous. If you have to then make sure you check the content of the string before you use it. Try this for more [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Stefan Braunewell</title>
		<link>http://blog.joshuaeichorn.com/archives/2005/08/01/using-eval-in-php/comment-page-1/#comment-5733</link>
		<dc:creator>Stefan Braunewell</dc:creator>
		<pubDate>Mon, 13 Feb 2006 15:17:29 +0000</pubDate>
		<guid isPermaLink="false">http://blog.joshuaeichorn.com/?p=166#comment-5733</guid>
		<description>Eval is not inherently slow, it just has a small constant run-time every time it&#039;s called. To assess the speed of eval() php parsing itself, you can put the for-loop inside the eval function. Results:

Eval: 1000000 times took 8.4494090080261
Same code not eval:  1000000 times took 0.83726000785828
Loop in eval took 1.0076489448547

You can see: executing code in eval is not the problem - envoking it so many times is.</description>
		<content:encoded><![CDATA[<p>Eval is not inherently slow, it just has a small constant run-time every time it&#8217;s called. To assess the speed of eval() php parsing itself, you can put the for-loop inside the eval function. Results:</p>
<p>Eval: 1000000 times took 8.4494090080261<br />
Same code not eval:  1000000 times took 0.83726000785828<br />
Loop in eval took 1.0076489448547</p>
<p>You can see: executing code in eval is not the problem &#8211; envoking it so many times is.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Joshua Eichorn</title>
		<link>http://blog.joshuaeichorn.com/archives/2005/08/01/using-eval-in-php/comment-page-1/#comment-5213</link>
		<dc:creator>Joshua Eichorn</dc:creator>
		<pubDate>Mon, 21 Nov 2005 15:16:48 +0000</pubDate>
		<guid isPermaLink="false">http://blog.joshuaeichorn.com/?p=166#comment-5213</guid>
		<description>Jorge:
In a situation like that is no great way to garentee security.  What you&#039;ll want to do is remove the runtime eval by just writing the new code to files (helps performance too) and then focus on making sure that only the admin can write new code.</description>
		<content:encoded><![CDATA[<p>Jorge:<br />
In a situation like that is no great way to garentee security.  What you&#8217;ll want to do is remove the runtime eval by just writing the new code to files (helps performance too) and then focus on making sure that only the admin can write new code.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Jorge</title>
		<link>http://blog.joshuaeichorn.com/archives/2005/08/01/using-eval-in-php/comment-page-1/#comment-5212</link>
		<dc:creator>Jorge</dc:creator>
		<pubDate>Mon, 21 Nov 2005 09:43:56 +0000</pubDate>
		<guid isPermaLink="false">http://blog.joshuaeichorn.com/?p=166#comment-5212</guid>
		<description>Hello, its a very interesting article. I am building a cms and considered eval to allow the cms admin to write modules on the fly using php and eval. I know that eval is quite dangerous and that&#039;s why I&#039;m lookig for information about coding it safely. What do you think about it? Should I try something different? Do you think it is possible to make it safely anyway?

Jorge</description>
		<content:encoded><![CDATA[<p>Hello, its a very interesting article. I am building a cms and considered eval to allow the cms admin to write modules on the fly using php and eval. I know that eval is quite dangerous and that&#8217;s why I&#8217;m lookig for information about coding it safely. What do you think about it? Should I try something different? Do you think it is possible to make it safely anyway?</p>
<p>Jorge</p>
]]></content:encoded>
	</item>
</channel>
</rss>

