Risks of using PHP eval for string math

Question

I have a question about eval() secourity risks

This is my own code

<?php

$str = 'nabi<'.$_GET['hackme']; // $_GET['hackme']=2;

$str = str_replace("nabi", 1, $str);

$hmm = eval('return ('.$str.');');

if($hmm){
    echo 'yeah';
}
else{
    echo 'no';
}

Result is will be:

yeah

My code workes well

It's what i want!

But i am afraid of the security risks!

Please offer a new solution

Answer 1

If all you're doing is checking if something is less than 1, typecast $_GET['hackme'] to int or double.

$str = 'nabi<' . (int) $_GET['hackme'];