Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
Search - "why are my tags so long"
-
I had a dream once that I gave up coding to join a monetary.
Is my subconscious trying to tell me something?undefined why are my tags so long catholic school influence possible new years resolution? addiction2 -
The dangers of PHP eval()
Yup. "Scary, you better make use of include instead" — I read all the time everywhere. I want to hear good case scenarios and feel safe with it.
I use the eval() method as a good resource to build custom website modules written in PHP which are stored and retrieved back from a database. I ENSURED IS SAFE AND CAN ONLY BE ALTERED THROUGH PRIVILEGED USERS. THERE. I SAID IT. You could as well develop a malicious module and share it to be used on the same application, but this application is just for my use at the moment so I don't wanna worry more or I'll become bald.
I had to take out my fear and confront it in front of you guys. If i had to count every single time somebody mentions on Stack Overflow or the comments over PHP documentation about the dangers of using eval I'd quit already.
Tell me if I'm wrong: in a safe environment and trustworthy piece of code is it OK to execute eval('?>'.$pieceOfCode); ... Right?
The reason I store code on the database is because I create/edit modules on the web editor itself.
I use my own coded layers to authenticate a privileged user: A single way to grant access to admin functions through a unique authentication tunnel granting so privileged user to access the editor or send API requests, custom htaccess rules to protect all filesystem behind the domain root path, a custom URI controller + SSL. All this should do the trick to safely use the damn eval(), is that right?!
Unless malicious code is found on the code stored prior to its evaluation.
But FFS, in such scenario, why not better fuck up the framework filesystem instead? Is one password closer than the database.
I will need therapy after this. I swear.
If 'eval is evil' (as it appears in the suggested tags for this post) how can we ensure that third party code is ever trustworthy without even looking at it? This happens already with chrome extensions, or even phone apps a long time after reaching to millions of devices.11 -
YouTube... for video creation.
Now I know I was a really amateurist video maker trying to make tutorials and videos about his coding creations in Mugen (you know, CNS state controllers and stuff,...), but this is the kind that's hard to get views from if you don't have a reach long enough to appear in search pages. I've had fun tagging my videos with plenties of tags just so they appear someday as a relevant result. EVEN in search pages for videos in the week, they barely appear and are sunk under videos of your Nth Mugen KOF clone with broken chars, Mugen ryona, Mugen hentai,... Speaking of which, did you know someone got to one of my videos from one of these?! How does YouTube's recommendation system work at this point?!
In the meantime (more like recently), I've been more interested in Ikemen, still kinda Mugen, still a DSL for a game engine, but still fascinating and there's material for tutorial making. But if I ever went back on video making, that won't be on YouTube. I'll just stick on Twitter and Discord if I were to share my content. At least, I got people following me there and a base visibility over there to start with. I could consider forums as well, why not, but YouTube is a no-go for me now.3