3v4l.org

run code in 300+ PHP versions simultaneously

@ 2020-11-23T13:50:06Z

<?php

$testData = [
    // this is the demo email used in the proof of concept of the exploit
    '"attacker\" -oQ/tmp/ -X/var/www/cache/phpcode.php "@email.com',
    // trying more adresses
    '"Attacker -Param2 -Param3"@test.com',
    '\'Attacker -Param2 -Param3\'@test.com',
    '"Attacker \" -Param2 -Param3"@test.com',
    "'Attacker \\' -Param2 -Param3'@test.com",
    '"attacker\" -oQ/tmp/ -X/var/www/cache/phpcode.php "@email.com',
    // and even more variants
    '"attacker\"\ -oQ/tmp/\ -X/var/www/cache/phpcode.php"@email.com',
    "\"attacker\\\"\0-oQ/tmp/\0-X/var/www/cache/phpcode.php\"@email.com",
    '"attacker@cebe.cc\"-Xbeep"@email.com',

    "'attacker\\' -oQ/tmp/ -X/var/www/cache/phpcode.php'@email.com",
    "'attacker\\\\' -oQ/tmp/ -X/var/www/cache/phpcode.php'@email.com",
    "'attacker\\\\'\\ -oQ/tmp/ -X/var/www/cache/phpcode.php'@email.com",
    "'attacker\\';touch /tmp/hackme'@email.com",
    "'attacker\\\\';touch /tmp/hackme'@email.com",
    "'attacker\\';touch/tmp/hackme'@email.com",
    "'attacker\\\\';touch/tmp/hackme'@email.com",
    '"attacker\" -oQ/tmp/ -X/var/www/cache/phpcode.php "@email.com',
];

foreach ($testData as $email) {
   echo "$email: " . (filter_var($email, FILTER_VALIDATE_EMAIL) ? 'Valid' : 'Invalid') . "\n";    
}

Output for git.master_jit, git.master, rfc.property-hooks: "attacker\" -oQ/tmp/ -X/var/www/cache/phpcode.php "@email.com: Invalid "Attacker -Param2 -Param3"@test.com: Invalid 'Attacker -Param2 -Param3'@test.com: Invalid "Attacker \" -Param2 -Param3"@test.com: Invalid 'Attacker \' -Param2 -Param3'@test.com: Invalid "attacker\" -oQ/tmp/ -X/var/www/cache/phpcode.php "@email.com: Invalid "attacker\"\ -oQ/tmp/\ -X/var/www/cache/phpcode.php"@email.com: Valid "attacker\"-oQ/tmp/-X/var/www/cache/phpcode.php"@email.com: Invalid "attacker@cebe.cc\"-Xbeep"@email.com: Valid 'attacker\' -oQ/tmp/ -X/var/www/cache/phpcode.php'@email.com: Invalid 'attacker\\' -oQ/tmp/ -X/var/www/cache/phpcode.php'@email.com: Invalid 'attacker\\'\ -oQ/tmp/ -X/var/www/cache/phpcode.php'@email.com: Invalid 'attacker\';touch /tmp/hackme'@email.com: Invalid 'attacker\\';touch /tmp/hackme'@email.com: Invalid 'attacker\';touch/tmp/hackme'@email.com: Invalid 'attacker\\';touch/tmp/hackme'@email.com: Invalid "attacker\" -oQ/tmp/ -X/var/www/cache/phpcode.php "@email.com: Invalid

This tab shows result from various feature-branches currently under review by the php developers. Contact me to have additional branches featured.

Active branches

Archived branches

Once feature-branches are merged or declined, they are no longer available. Their functionality (when merged) can be viewed from the main output page

2022-12-01 RFC: Property hooks - included in PHP 8.4
2020-03-21 RFC: Is_Literal - declined
2020-12-04 Enumerations - included in PHP 8.1
2018-06-15 Typed Properties v2 - implemented in PHP 7.4
2016-08-12 Object typehint - included in PHP 7.2
2016-08-14 Arrow functions - withdrawn
2016-05-29 array_change_keys() - withdrawn
2016-04-19 Lexical scope support for anonymous classes - suspended
2016-04-17 Functional Interfaces - declined
2016-03-16 Typed Properties - superseded in favor of Typed Properties 2.0
2015-08-27 Callable Prototypes - declined
2015-05-01 Short Closures - declined / withdrawn in favor of Arrow Functions
2015-02-18 Scalar type hints v5 - included in PHP 7
2015-02-14 Union Types - declined
2013-09-22 Anonymous classes - included in PHP 7

preferences:dark modelive previewkey bindings

32.22 ms | 408 KiB | 5 Q