| Conditions | 1 |
| Paths | 1 |
| Total Lines | 14 |
| Code Lines | 8 |
| Lines | 0 |
| Ratio | 0 % |
| Changes | 0 | ||
| 1 | <?php |
||
| 28 | public function renderTemplate($templateString, $context) |
||
| 29 | { |
||
| 30 | // Prevents leaking global variable by forcing anonymous scope |
||
| 31 | $render = function($templateString, $context) { |
||
| 32 | extract($context); |
||
| 33 | return eval('?>'.$templateString); |
||
|
|
|||
| 34 | }; |
||
| 35 | |||
| 36 | ob_start(); |
||
| 37 | $render($templateString, $context); |
||
| 38 | $output = ob_get_clean(); |
||
| 39 | |||
| 40 | return $output; |
||
| 41 | } |
||
| 42 | } |
||
| 43 |
On one hand,
evalmight be exploited by malicious users if they somehow manage to inject dynamic content. On the other hand, with the emergence of faster PHP runtimes like the HHVM,evalprevents some optimization that they perform.