Is it possible to make a "php injection"? -

i'm building web application , i'm concern security.

is way make "php injection", in same way possible make "sql injection" ? means client can send php code executed on server.

until don't use "eval" function, "no" because when value $_get , $_post, data treated simple string... maybe don't see obvious attack.

in general, not unless evaluate might parse , execute php. mentioned eval, there other functions have eval-like properties (e.g. preg_replace, if attacker manages inject /e modifier) or can otherwise allow unwanted levels of access (e.g. system()).

also, if attacker can upload file , interpreted php, can run php code. nginx can easily misconfigured in way allows attackers execute php code in image files. same goes getting web site include() code - possibly overwriting files uploads, or changing include() arguments point remote site (if not disabled in php.ini).