Core feature
Functions & variables
Use a focused allowlist of math functions and pass values explicitly from your application.
Small allowlist, predictable domains.
Built-ins such as sqrt, sin, cos, log, min, and max are validated for arity and domain before execution. Variables are supplied per call and never read from global PHP state.
01
Pass values
Keep user input separate from trusted application data.
02
Register safely
Add a custom function with an explicit name, arity, and callback.