The problem with disable_functions is that eval is not an internal function, but a language construct. From the manual:

Only internal functions can be disabled using this directive.

It is possible to generate something like a list of all available internal functions, eval is missing here:

  $arr = get_defined_functions();
  var_dump($arr['internal']);

The Suhosin extension will let you block eval, if it is available:

http://www.hardened-php.net/suhosin/configuration.html#suhos...