Securely evaluate simple maths - php

Question

I would like to know if there was a secure way to evaluate mathematics like
2+2
10000+12000
10000-20
2 + 2
40 - 20 + 23 - 12
Without having to use eval() because the input can come from any users. The things I'd need to implement are only additions and subtractions of whole numbers.
Is there any snippets that already exists for that, or any PHP functions I haven't come across?

Answer 1

I would question using eval, considering the variety of mathematic functions available in PHP. You've said you only want to do simple math -- the only reason to use eval is to perform more complex operations, or to accept the equations whole-cloth from the user.
If you just want to add or subtract, sanitize the input with intval and go to town:
$number1 = '100';
$number2 = 'shell_exec(\'rm -rf *\')';
echo intval($number1) + intval($number2); // 100
Try it: http://codepad.org/LSUDUw1M
This works because intval ignores anything non-numeric.
If you are indeed getting the whole equation from user input (ie 100 - 20), you can use preg_replace to remove anything except the allowed operators and numbers:
$input = '20 + 4; shell_exec(\'rm *\')';
$input = preg_replace(
'/[^0-9+-]/',
'',
$input
);
eval('$result = '.$input.';');
echo 'result: '.$result; // 24
Try it: http://codepad.org/tnISDPJ3
Here, we're using the regex /[^0-9+-]/, which matches anything NOT 0-9 OR + OR - and replaces it with an empty string.
If you want to get more in to depth with allowed equations, taken straight from the eval manual page:
// credit for code to bohwaz (http://www.php.net/manual/en/function.eval.php#107377)
$test = '2+3*pi';
// Remove whitespaces
$test = preg_replace('/\s+/', '', $test);
$number = '(?:\d+(?:[,.]\d+)?|pi|π)'; // What is a number
$functions = '(?:abs|a?cosh?|a?sinh?|a?tanh?|exp|log10|deg2rad|rad2deg|sqrt|ceil|floor|round)'; // Allowed PHP functions
$operators = '[+\/*^%-]'; // Allowed math operators
$regexp = '/^(('.$number.'|'.$functions.'\s*\((?1)+\)|\((?1)+\))(?:'.$operators.'(?2))?)+$/'; // Final regexp, heavily using recursive patterns
if (preg_match($regexp, $q))
{
$test = preg_replace('!pi|π!', 'pi()', $test); // Replace pi with pi function
eval('$result = '.$test.';');
}
else
{
$result = false;
}
Documentation
preg_replace - http://php.net/manual/en/function.preg-replace.php
intval - http://php.net/manual/en/function.intval.php
eval - http://php.net/manual/en/function.eval.php
PHP Math functions - http://www.php.net/manual/en/ref.math.php

Answer 2

You could parse the expressions yourself.
Something like this:
// Minus is the same as plus a negative
// Also remove spaces after minus signs
$str = preg_replace('/-\s*(\d+)/', '+-$1', $str);
// Split on plusses
$nums = explode('+', $str);
// Trim values
$nums = array_map('trim', $nums);
// Add 'em up
echo array_sum($nums);
DEMO: http://codepad.org/ANc0gh27

Answer 3

I used this method in calculator script.
$field1 = $_GET["field1"];
$field2 = $_GET["field2"];
$answer = $field1 + $field2;
echo "$field1 + $field2 = $answer";