| Conditions | 2 |
| Paths | 2 |
| Total Lines | 12 |
| Code Lines | 9 |
| Lines | 0 |
| Ratio | 0 % |
| Changes | 0 | ||
| 1 | <?php |
||
| 61 | public function evaluate($record) |
||
| 62 | { |
||
| 63 | $recordField = $record[$this->columnIndex]; |
||
| 64 | if (preg_match("/^([<>=]{1,2})\s*(.*)/", $this->value, $matches)) { |
||
| 65 | $op = $matches[1]; |
||
| 66 | $value= floatval($matches[2]); |
||
| 67 | $recordField = strval($recordField); |
||
| 68 | eval("\$result = $recordField $op $value;"); |
||
|
|
|||
| 69 | return $result; |
||
| 70 | } |
||
| 71 | return $recordField == $this->value; |
||
| 72 | } |
||
| 73 | |||
| 107 |
On one hand,
evalmight be exploited by malicious users if they somehow manage to inject dynamic content. On the other hand, with the emergence of faster PHP runtimes like the HHVM,evalprevents some optimization that they perform.