Code Injection
A code injection is a vulnerability, where external data is used as PHP code.
In the example below, $_GET is directly used in the eval() function. By using a clever string, as shown in the illustration below, it is possible to assign the variable, and run the phpinfo() command.
Among the solutions to mitigate this problem: filter adequately the incoming data; use prepared statements.
Some PHP functions are sensitive to this kind of attack: eval(), include(), include_once(), require(), require_once(). Dynamic calls are also susceptible to code injection.
<?php
// $_GET['x'] = '1; phpinfo()';
eval($myvar = $x);
// $_GET['method'] = 'getSafe';
// Any method may be called on the safe object
$data->$method();
?>