Agreed, when you are on patch #4 because the previous patches weren't effective, and you can't verify patch #4 because of time constraints, it might be time to step back and reconsider the approach.

Sounds like they should just not be eval()ing user input regardless of how much sanitization they throw at it.