3v4l.org

run code in 500+ PHP versions simultaneously
<?php $string = '<img src="{{ a }}" />'; $payload = '" onload="alert(\'XSS!\');"'; var_dump( str_replace( '{{ a }}', htmlentities($payload, ENT_QUOTES | ENT_HTML5, 'UTF-8'), $string ) ); var_dump( str_replace( '{{ a }}', "/somefile.php?".http_build_query(array('url' => $payload)), $string ) ); var_dump( str_replace( '{{ a }}', urlencode($payload), $string ) );
Output for 5.4.0 - 5.4.45, 5.5.0 - 5.5.38, 5.6.0 - 5.6.40, 7.0.0 - 7.0.33, 7.1.0 - 7.1.33, 7.2.0 - 7.2.34, 7.3.0 - 7.3.33, 7.4.0 - 7.4.33, 8.0.0 - 8.0.30, 8.1.0 - 8.1.34, 8.2.0 - 8.2.30, 8.3.0 - 8.3.30, 8.4.1 - 8.4.18, 8.5.0 - 8.5.3
string(91) "<img src="&quot; onload&equals;&quot;alert&lpar;&apos;XSS&excl;&apos;&rpar;&semi;&quot;" />" string(77) "<img src="/somefile.php?url=%22+onload%3D%22alert%28%27XSS%21%27%29%3B%22" />" string(59) "<img src="%22+onload%3D%22alert%28%27XSS%21%27%29%3B%22" />"
preferences:
92.99 ms | 2436 KiB | 4 Q