is escaping eval variables safe enough?

Question

Is escaping eval variables safe enough from security point of view. For e.g.

$path = "a";    //sample value; is generated dynamically
$var = "phpinfo()";     //sample attack value; is generated dynamically
eval("\$struct$path = \$var;");

this seems to be working safely to me. Although there seems to be no reason of using the code in the first place, now that it is in, it cannot be removed without a reason.

Is there any way (any value for $var or $path) that can break this eval or is it that i am simply worrying too much :-) and this is a safe case???

Answer 1

It depends on where $path is coming from. This value breaks it:

=0;unlink('/important/file');//

Answer 2

You could need eval to implement a plugin system with hooks... But you should never execute dynamic content with it (like phpinfo).

Answer 3

I have no clue what your eval code is actually supposed to do. But if it's just about a dynamic varname how about something like that:

extract(array("\$struct$path", "\$var"));

Faster.