All rules →
Rules / PHP
SHIELD-PHP-005

Code injection via eval or assert on variables

criticalPHPCWE-95CVSS 9.8

What it detects

eval, assert, or create_function receives a variable allowing arbitrary PHP code execution.

How to fix

Never pass dynamic input to eval/assert; refactor to avoid dynamic code evaluation.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PHP-005: Code injection via eval or assert on variables — Zennoxa Shield