Trying to work on two numbers with operation as $_request['operation']

Question

I am trying to get the value of $result but it gives 2+4 as I am giving values $first=2, $second=4 and $operation= +.

<?php
$first     = $_REQUEST['first'];
$second    = $_REQUEST['second'];
$operation = $_REQUEST['operation'];
echo $result = "$first+$operation+$second";
?>

<form id="dpk-form" action="" method="post">
    <label>First No:</label>  <input name="first" type="text" /><br /><br />
    <label>Second No:</label> <input name="second" type="text" /><br /><br />
    <label>Operation:</label> <input name="operation" type="text" /><br /><br />
    <input type="submit" value="Submit" /><br /><br />
    <label>Result:</label> <input name="result" type="text" /><br />
</form>

Marcin Nabiałek · Answer 1 · 2014-07-18T07:10:37.557

3

There's no simple way do use operator as variable. You could use eval() but it's not the best practice.

I would do it this way:

switch  ($_REQUEST['operation']) {
    case '+':
        $result = $first + $second;
        break;
    case '-':
        $result = $first - $second;
        break;        
}

echo $result;

Of course you should add to switch other operators you want to use and of course if you want to use divide, you need to consider dividing by 0.

edited Jul 18 '14 at 07:10

answered Jul 18 '14 at 07:05

Marcin Nabiałek

109,655
42
258
291

I don't think this is going to work. `$operation` is the `+`. So you are saying `2+++4`... – Mark Miller Jul 18 '14 at 07:07
@MarkM Earlier was completely different question – Marcin Nabiałek Jul 18 '14 at 07:08
Did you noticed that `$operation === '+'`? – Aleksei Matiushkin Jul 18 '14 at 07:08
Thanks Marcin But it only works with addition not with subtraction and so forth.. – DeePak Chattha Jul 18 '14 at 07:09
Then again, I guess it does work: http://codepad.org/8CQphzOX. But only for addition... – Mark Miller Jul 18 '14 at 07:11
Please don't refer to `eval`. When you deal with user-supplied data (`$_REQUEST`), `eval` is not safe! – Sven Koschnicke Jul 18 '14 at 07:13
@MarkM It does not work. Simple '+' is converted to 0. You could also write `echo $a + 'x' + $b;` and you would get the same `correct` answer – Marcin Nabiałek Jul 18 '14 at 07:14

score 0 · Answer 2 · answered Jul 18 '14 at 07:06

0

$result = eval($first.$operation.$second);

It’s a really bad and generally dangerous practice to call eval in such circumstances, though.

answered Jul 18 '14 at 07:06

Aleksei Matiushkin

119,336
10
100
160

2

It's generally bad but **in this special case it is disastrous because it executes arbitrary code supplied by anyone calling this script**. Don't do that! – Sven Koschnicke Jul 18 '14 at 07:11
@SvenKoschnicke agreed, but not worth a downvote since it solves the problem. Also he gave a hint that it's usage is not recommended. OP should decide by himself. With great power comes great responsibility ... – thpl Jul 18 '14 at 07:15
Thanks @ThomasDavidPlat. I saw that’s not the master question, developing the huge payment-aware project, therefore I gave such an answer. – Aleksei Matiushkin Jul 18 '14 at 07:18
1

Even if something solves the problem it can be bad. I didn't downvote, though. – Sven Koschnicke Jul 18 '14 at 07:22
@SvenKoschnicke totally! That's why I agreed with you. However Stack Overflow is not a code on demand platform. There are differnt possible solutions to the most of the questions and whosoever is asking a question here, should compare the upsides and the downsides of the answers given by himself. – thpl Jul 18 '14 at 07:26

score 0 · Answer 3 · answered Jul 18 '14 at 07:12

Eval-free route, but you need to predefine your allowed operations:

switch ($operation) {
    case '+':
        echo $first + $second;
        break;
    case '-':
        echo $first - $second;
        break;
    case '/':
        echo $first / $second;
        break;
    case '*':
        echo $first * $second;
        break;
    case '%':
        echo $first % $second;
        break;
}

score 0 · Answer 4 · edited May 23 '17 at 11:57

That is not going to work, since . is a string concatenatination operator, hence every expression is tried to be casted to a string.

You could use eval here but I would not recommend the usage.

You could either use a switch statement here.

switch($_REQUEST['operation'])
{
    case '+':
        $result = $_REQUEST['first'] + $_REQUEST['second'];
        break;
    case '-':
        $result = $_REQUEST['first'] - $_REQUEST['second'];
        break;

    // ...
}

But that comes with the downside of high maintaining costs and is not very DRY. If you are more advanced you might want to go with the strategy pattern.

Trying to work on two numbers with operation as $_request['operation']

4 Answers4