Era Host hosting
EraHost – Free Domain, Cheap Hosting!
Client Area
Support 24/7
Menu

assert_quiet_eval in PHP — Explanation & Troubleshooting Guide

3 min read
03.04.2026

What is assert_quiet_eval?

assert_quiet_eval is an internal PHP function used in phpMyAdmin and some other PHP-based applications. It is a wrapper around PHP's eval() function but suppresses error messages to prevent them from being displayed directly to users.

assert_quiet_eval PHP Troubleshooting
assert_quiet_eval — a malware artifact, almost never legitimate PHP.

For related PHP-runtime errors that surface during malware cleanup, see vqmod::bootup — PHP domdocument Extension Required and Fix proc_open() Has Been Disabled for Security Reasons.

It is commonly used in:

  • phpMyAdmin's SQL execution system
  • Debugging and security checks
  • Executing PHP code safely within controlled environments

Note: assert_quiet_eval is not a standard PHP function, but is part of phpMyAdmin's internal implementation.

Troubleshooting assert_quiet_eval Errors in phpMyAdmin

If you see an error related to assert_quiet_eval, it is usually due to:

  1. Deprecated function in newer PHP versions
  2. Disabled eval() function in php.ini for security reasons
  3. Corrupted phpMyAdmin files
  4. Incorrect web server configuration

Check PHP Version Compatibility

Since assert_quiet_eval is an internal function, it may be deprecated or missing in certain PHP versions.

Check Your PHP Version

php -v

If your PHP version is 8.0 or later, some phpMyAdmin functions may break due to deprecated code.

Solution

If using PHP 8+, downgrade to PHP 7.4 (if phpMyAdmin requires it):

sudo apt install php7.4 php7.4-mysql php7.4-mbstring php7.4-xml php7.4-gd
sudo a2dismod php8.0
sudo a2enmod php7.4
sudo systemctl restart apache2
Linux VDS
High performance for your projects
  • Root access and flexible setup
  • Control panel
  • NVMe disks
  • DDR5
Linux VDS

Check if eval() is Disabled in php.ini

Some security-conscious configurations disable eval() to prevent remote code execution.

Locate Your php.ini File

Run:

php --ini | grep "Loaded Configuration File"

Then edit the file:

sudo nano /etc/php/8.0/apache2/php.ini

(or adjust the PHP version accordingly)

Check disable_functions

Find this line:

disable_functions = eval, exec, shell_exec, system

If eval is listed, remove it, then restart Apache:

sudo systemctl restart apache2

or for Nginx:

sudo systemctl restart nginx php8.0-fpm

Reinstall phpMyAdmin

If assert_quiet_eval errors persist, phpMyAdmin files may be corrupted.

Backup and Remove Existing Installation

sudo mv /usr/share/phpmyadmin /usr/share/phpmyadmin_backup
sudo apt remove phpmyadmin -y

Reinstall phpMyAdmin

For Debian/Ubuntu:

sudo apt update
sudo apt install phpmyadmin -y

For manual installation:

cd /var/www/
wget https://files.phpmyadmin.net/phpMyAdmin/latest/phpMyAdmin-latest-all-languages.zip
unzip phpMyAdmin-latest-all-languages.zip -d phpmyadmin
rm phpMyAdmin-latest-all-languages.zip
sudo chown -R www-data:www-data /var/www/phpmyadmin
sudo chmod -R 755 /var/www/phpmyadmin

Restart Apache:

sudo systemctl restart apache2

Check Web Server Logs

If the issue persists, check for server-related errors.

Check Apache Logs

sudo tail -f /var/log/apache2/error.log

Check Nginx Logs

sudo tail -f /var/log/nginx/error.log

By following these steps, you should be able to resolve assert_quiet_eval errors in phpMyAdmin and other PHP applications.

Frequently asked questions
No. There is no `assert_quiet_eval` in any PHP version. If you see it, it's either a typo in a deprecated codebase or — more commonly — a malware artifact: attacker code that mis-names a function. Look up the file in error log and treat as compromised.
Pre-PHP 7.2, `assert("some_code()")` would `eval()` the string. Attackers love it: a single legitimately-named function call disguises arbitrary code execution. PHP 7.2 deprecated string-form assert; PHP 8 removed it entirely. If your server runs PHP 7.1 or older with eval-mode assert, an injected `assert($payload)` is RCE.
1) Quarantine the file (move to a non-web-accessible location for forensics, don't just rm). 2) `find / -name '*.php' -newer ` for other recently-modified PHPs. 3) Diff against a known-good copy of the CMS. 4) Rotate every password (admin, DB, FTP, SSH). 5) Identify the entry vector — most often a vulnerable plugin or weak FTP password. Patching the backdoor without finding entry just buys 24-48h.
PHP 7.x: set `zend.assertions = -1` (production) and `assert.exception = 1` in php.ini. With `zend.assertions = -1`, assert calls are stripped at compile time — zero overhead and no eval. PHP 8: string-form assert is a fatal error already, so just upgrade. For shared hosting where you can't change php.ini globally, add to `.user.ini`.
Related articles
mbstring.internal_encoding — Complete PHP Guide
Fixing "A Fatal Error or Timeout Occurred While Processing This Directive"
Set Encoding for Dynamic Content with charset=windows-1251