title: What can I use instead of eval()?
body: <p>I have a string that stores some variables that must be executed to produce a result, for example:</p>
  
  <pre><code>define('RUN_THIS', '\$something.",".$somethingElse');
  </code></pre>
  
  <p>Which is then <code>eval()</code>-uated:</p>
  
  <pre><code>$foo = eval("return ".RUN_THIS.";");
  </code></pre>
  
  <p>I understand that eval is unsafe if the string that gets evaluated is from user input. However, if for example I wanted to have everything run off Facebook's HipHop which doesn't support eval() I couldn't do this.</p>
  
  <p>Apparently I can use <code>call_user_func()</code> - is this effectively the same result as <code>eval()</code>? How is deemed to be secure when <code>eval()</code> isn't, if that is indeed the case?</p>
  
  <p><strong>Edit:</strong> 
  In response to the comments, I didn't originally make it clear what the goal is. The constant is defined in advance in order that later code, be it inside a class that has access to the configuration constants, or procedural code, can use it in order to evaluate the given string of variables. The variables that need to be evaluated can vary (completely different names, order, formatting) depending on the situation but it's run for the same purpose in the same way, which is why I currently have the string of variables set in a constant in this way. Technically, <code>eval()</code> is not unsafe as long as the config.php that defines the constants is controlled but that wasn't the point of the question.</p>