eval()

Introduction to the eval() Function

The eval() function evaluates a string as PHP code and runs it at runtime — the moment the script reaches the eval() call. Instead of writing code that the PHP parser compiles up front, you hand eval() a string that is compiled and executed on the fly.

This makes eval() one of the most powerful — and most dangerous — constructs in the language. This page covers its syntax, what it returns, the rare cases where it is genuinely useful, the security risks that make it a last resort, and the safer alternatives you should reach for first.

eval() is a language construct, not a regular function. You cannot call it indirectly through a variable function name or pass it to callback functions.

Syntax

eval(string $code): mixed

The single argument is a string of PHP code. A few rules matter:

• Do not include the opening <?php tag. The string is treated as PHP source already, so adding <?php would actually drop you back into "HTML mode."
• The code must be syntactically valid and terminated. A missing semicolon or unbalanced brace produces a parse error. Since PHP 7, a parse error inside eval() throws a ParseError exception you can catch — older versions returned false.

Return Value

How eval() returns a value depends on what the evaluated code does:

• If the code runs a return statement, eval() returns that value.
• Otherwise it returns null.

<?php

$result = eval('return 2 + 3;');
echo $result; // 5

This is why a return inside eval() ends the evaluated string, not your whole script — control comes back to the line after eval(). See the return statement for how return behaves in regular functions.

Basic Example

Here's the simplest possible use — building a string of code and executing it:

The $code variable holds valid PHP that prints Hello, world!. eval() compiles and runs that string at runtime, so the message is displayed. Note there is no <?php tag inside the string.

Catching Errors Safely

Because invalid code throws a ParseError, wrap untrusted or generated code in a try/catch block so a bad string does not crash the whole request:

<?php

try {
    eval('echo "missing semicolon"'); // no terminating ;
} catch (ParseError $e) {
    echo "Could not evaluate: " . $e->getMessage();
}

This prints a "Could not evaluate" message instead of a fatal error, letting your script continue.

When Would I Use eval()?

In modern PHP, almost never — and that is the honest answer. Legitimate, narrow use cases include:

• Template/expression engines that compile a custom mini-language into PHP (Twig and Blade do something conceptually similar, but with heavy sandboxing).
• Caching compiled configuration as PHP that is later eval'd, though writing a real .php file and using include is faster and safer.
• Educational or debugging tools such as REPLs where the input is fully trusted.

If the value you need to compute is data (numbers, JSON, a list of options), you almost certainly do not need eval().

Security Risks

eval() executes whatever it is given. If any part of the string can be influenced by user input, an attacker can run arbitrary code — read files, delete data, or take over the server. This is a classic remote code execution (RCE) vulnerability.

<?php

// NEVER do this:
$expr = $_GET['expr'];          // attacker-controlled
eval("\$answer = $expr;");      // attacker can inject any PHP

A request like ?expr=1; system('rm -rf /') would run the injected command. Treat every eval() on user input as a guaranteed exploit.

Safer Alternatives

Before reaching for eval(), check whether one of these covers your need:

Conclusion

eval() evaluates a string as PHP code at runtime, returning the result of a return statement inside it or null otherwise. It is genuinely powerful, but it is also a top source of security holes — any user-controlled input passed to it is a remote-code-execution bug. Use it only when the input is fully trusted and no built-in construct fits, wrap it in a try/catch for ParseError, and prefer the safer alternatives above whenever possible.

Practice