I have a basic security question about Magento 2.1

Do any of the modules in a default installation allow the execution of arbitrary PHP code directly from a database field? I'm assuming not, but I need to check.

  • you can check all the files in the folders called Setup inside each module. I would say no, but you can check it yourself.
    – Marius
    Jan 10, 2017 at 17:58

1 Answer 1


No. This would be a major security flaw that I cannot imagine would make it through code review at Magento.

To confirm, search for usages of the eval PHP function in the code base: no results.

  • 1
    Always remember: eval === evil. But beware of 3rd party extensions: there are some extensions out there that indeed store PHP code in the database and use eval() to run it. Always code review 3rd party extensions! Jan 11, 2017 at 7:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.