I am wondering what security concerns there are to implementing a `PHP evaluator` like this:

```
<?php eval($_POST['codeInput']); %>

```

This is in the context of making a `PHP sandbox` so sanitising against `DB input` etc. isn't a massive issue.

Users destroying the server the file is hosted on is.

I've seen `Ruby simulators` so I was curious what's involved security wise (vague details at least).

---

Thanks all. I'm not even sure on which answer to accept because they are all useful.

[Owen's answer](https://stackoverflow.com/questions/131902/what-are-the-security-concerns-of-evaluating-user-code-in-php#131911) summarises what I suspected (the server itself would be at risk).

[arin's answer](https://stackoverflow.com/questions/131902/what-are-the-security-concerns-of-evaluating-user-code-in-php#137019) gives a great example of the potential problems.

[Geoff's answer](https://stackoverflow.com/questions/131902/what-are-the-security-concerns-of-evaluating-user-code-in-php#137167) and [randy's answer](https://stackoverflow.com/questions/131902/what-are-the-security-concerns-of-evaluating-user-code-in-php#137118) echo the general opinion that you would need to write your own evaluator to achieve simulation type capabilities.