php.module

<?php

/**
 * @file
 * Additional filter for PHP input.
 */

/**
 * Implements hook_help().
 */
function php_help($path, $arg) {
  switch ($path) {
    case 'admin/help#php':
      $output = '';
      $output .= '<h3>' . t('About') . '</h3>';
      $output .= '<p>' . t('The PHP Filter module adds a PHP filter to your site, for use with <a href="@filter">text formats</a>. This filter adds the ability to execute PHP code in any text field that uses a text format (such as the body of a content item or the text of a comment). <a href="@php-net">PHP</a> is a general-purpose scripting language widely-used for web development, and is the language with which Drupal has been developed. For more information, see the online handbook entry for the <a href="@php">PHP Filter module</a>.', array(
        '@filter' => url('admin/help/filter'),
        '@php-net' => 'http://www.php.net',
        '@php' => 'http://drupal.org/documentation/modules/php',
      )) . '</p>';
      $output .= '<h3>' . t('Uses') . '</h3>';
      $output .= '<dl>';
      $output .= '<dt>' . t('Enabling execution of PHP in text fields') . '</dt>';
      $output .= '<dd>' . t('The PHP Filter module allows users with the proper permissions to include custom PHP code that will get executed when pages of your site are processed. While this is a powerful and flexible feature if used by a trusted user with PHP experience, it is a significant and dangerous security risk in the hands of a malicious or inexperienced user. Even a trusted user may accidentally compromise the site by entering malformed or incorrect PHP code. Only the most trusted users should be granted permission to use the PHP filter, and all PHP code added through the PHP filter should be carefully examined before use. <a href="@php-snippets">Example PHP snippets</a> can be found on Drupal.org.', array(
        '@php-snippets' => url('http://drupal.org/documentation/customization/php-snippets'),
      )) . '</dd>';
      $output .= '</dl>';
      return $output;
  }
}

/**
 * Implements hook_permission().
 */
function php_permission() {
  return array(
    'use PHP for settings' => array(
      'title' => t('Use PHP for settings'),
      'restrict access' => TRUE,
    ),
  );
}

/**
 * Evaluates a string of PHP code.
 *
 * This is a wrapper around PHP's eval(). It uses output buffering to capture
 * both returned and printed text. Unlike eval(), we require code to be
 * surrounded by <?php ?> tags; in other words, we evaluate the code as if it
 * were a stand-alone PHP file.
 *
 * Using this wrapper also ensures that the PHP code which is evaluated can not
 * overwrite any variables in the calling code, unlike a regular eval() call.
 *
 * This function is also used as an implementation of
 * hook_filter_FILTER_process().
 *
 * @param $code
 *   The code to evaluate.
 *
 * @return
 *   A string containing the printed output of the code, followed by the
 *   returned output of the code.
 *
 * @ingroup php_wrappers
 *
 * @see php_filter_info()
 */
function php_eval($code) {
  global $theme_path, $theme_info;

  // Store current theme path.
  $old_theme_path = $theme_path;

  // Restore theme_path to the theme, as long as php_eval() executes,
  // so code evaluated will not see the caller module as the current theme.
  // If theme info is not initialized get the path from default theme.
  if (!isset($theme_info)) {
    $theme_path = drupal_get_path('theme', config('system.theme')
      ->get('default'));
  }
  else {
    $theme_path = dirname($theme_info->filename);
  }
  ob_start();
  print eval('?>' . $code);
  $output = ob_get_contents();
  ob_end_clean();

  // Recover original theme path.
  $theme_path = $old_theme_path;
  return $output;
}