title: safely using the eval function in php: modifying user input to avoid security issues
body: <p>I am taking over over some webgame code that uses the <a href="http://php.net/manual/en/function.eval.php" rel="nofollow">eval()</a> function in php. I know that this is potentially a serious security issue, so I would like some help vetting the code that checks its argument before I decide whether or not to nix that part of the code. Currently I have removed this section of code from the game until I am sure it's safe, but the loss of functionality is not ideal. I'd rather security-proof this than redesign the entire segment to avoid using eval(), assuming such a thing is possible. The relevant code snip which supposedly prevents malicious code injection is below. $value is a user-input string which we know does not contain ";".</p>
  
  <pre><code>1 $value = eregi_replace("[ \t\r]","",$value);
  2 $value = addslashes($value);
  3 $value = ereg_replace("[A-z0-9_][\(]","-",$value);
  4 $value = ereg_replace("[\$]","-",$value);
  5 @eval("\$val = $value;");
  </code></pre>
  
  <p>Here is my understanding so far: </p>
  
  <p>1) removes all whitespace from $value</p>
  
  <p>2) escapes characters that would need it for a database call (why this is needed is not clear to me)</p>
  
  <p>3) looks for alphanumeric characters followed immediately by \ or ( and replaces the combination of them with -. Presumably this is to remove anything resembling function calls in the string, though why it also removes the character preceding is unclear to me, as is why it would also remove \ after line 2 explicitly adds them. </p>
  
  <p>4) replaces all instances of $ with - in order to avoid anything resembling references to php variables in the string.</p>
  
  <p>So: have any holes been left here? And am I misunderstanding any of the regex above? Finally, is there any way to security-proof this without excluding ( characters? The string to be input is ideally a mathematical formula, and allowing ( would allow for manipulation of order of operations, which currently is impossible.</p>