3v4l.org

run code in 300+ PHP versions simultaneously
<?php // Challenge: make this terrible code safe // echo "<!doctype html>\n"; $_GET['username'] = 'foo'; $_GET['password'] = 'bar'; $username = @$_GET['username'] ? $_GET['username'] : $argv[1]; $password = @$_GET['password'] ? $_GET['password'] : $argv[2]; $password = md5($password); $pdo = new PDO('sqlite::memory:'); $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); $pdo->exec("DROP TABLE IF EXISTS users"); $pdo->exec("CREATE TABLE users (username VARCHAR(255), password VARCHAR(255))"); $rootPassword = md5("secret"); $pdo->exec("INSERT INTO users (username, password) VALUES ('root', '$rootPassword');"); $statement = $pdo->query("SELECT * FROM users WHERE username = '$username' AND password = '$password'"); if (count($statement->fetchAll())) { echo "Access granted to $username!<br>\n"; } else { echo "Access denied for $username!<br>\n"; }
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 11, Position 2 = 15
Branch analysis from position: 11
1 jumps found. (Code = 42) Position 1 = 17
Branch analysis from position: 17
2 jumps found. (Code = 43) Position 1 = 23, Position 2 = 27
Branch analysis from position: 23
1 jumps found. (Code = 42) Position 1 = 29
Branch analysis from position: 29
2 jumps found. (Code = 43) Position 1 = 71, Position 2 = 76
Branch analysis from position: 71
1 jumps found. (Code = 42) Position 1 = 80
Branch analysis from position: 80
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 76
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 27
2 jumps found. (Code = 43) Position 1 = 71, Position 2 = 76
Branch analysis from position: 71
Branch analysis from position: 76
Branch analysis from position: 15
2 jumps found. (Code = 43) Position 1 = 23, Position 2 = 27
Branch analysis from position: 23
Branch analysis from position: 27
filename:       /in/DLi9V
function name:  (null)
number of ops:  81
compiled vars:  !0 = $username, !1 = $argv, !2 = $password, !3 = $pdo, !4 = $rootPassword, !5 = $statement
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    6     0  E >   FETCH_W                      global              $6      '_GET'
          1        ASSIGN_DIM                                               $6, 'username'
          2        OP_DATA                                                  'foo'
    7     3        FETCH_W                      global              $8      '_GET'
          4        ASSIGN_DIM                                               $8, 'password'
          5        OP_DATA                                                  'bar'
    9     6        BEGIN_SILENCE                                    ~10     
          7        FETCH_R                      global              ~11     '_GET'
          8        FETCH_DIM_R                                      ~12     ~11, 'username'
          9        END_SILENCE                                              ~10
         10      > JMPZ                                                     ~12, ->15
         11    >   FETCH_R                      global              ~13     '_GET'
         12        FETCH_DIM_R                                      ~14     ~13, 'username'
         13        QM_ASSIGN                                        ~15     ~14
         14      > JMP                                                      ->17
         15    >   FETCH_DIM_R                                      ~16     !1, 1
         16        QM_ASSIGN                                        ~15     ~16
         17    >   ASSIGN                                                   !0, ~15
   10    18        BEGIN_SILENCE                                    ~18     
         19        FETCH_R                      global              ~19     '_GET'
         20        FETCH_DIM_R                                      ~20     ~19, 'password'
         21        END_SILENCE                                              ~18
         22      > JMPZ                                                     ~20, ->27
         23    >   FETCH_R                      global              ~21     '_GET'
         24        FETCH_DIM_R                                      ~22     ~21, 'password'
         25        QM_ASSIGN                                        ~23     ~22
         26      > JMP                                                      ->29
         27    >   FETCH_DIM_R                                      ~24     !1, 2
         28        QM_ASSIGN                                        ~23     ~24
         29    >   ASSIGN                                                   !2, ~23
   11    30        INIT_FCALL                                               'md5'
         31        SEND_VAR                                                 !2
         32        DO_ICALL                                         $26     
         33        ASSIGN                                                   !2, $26
   13    34        NEW                                              $28     'PDO'
         35        SEND_VAL_EX                                              'sqlite%3A%3Amemory%3A'
         36        DO_FCALL                                      0          
         37        ASSIGN                                                   !3, $28
   14    38        INIT_METHOD_CALL                                         !3, 'setAttribute'
         39        SEND_VAL_EX                                              3
         40        SEND_VAL_EX                                              2
         41        DO_FCALL                                      0          
   16    42        INIT_METHOD_CALL                                         !3, 'exec'
         43        SEND_VAL_EX                                              'DROP+TABLE+IF+EXISTS+users'
         44        DO_FCALL                                      0          
   17    45        INIT_METHOD_CALL                                         !3, 'exec'
         46        SEND_VAL_EX                                              'CREATE+TABLE+users+%28username+VARCHAR%28255%29%2C+password+VARCHAR%28255%29%29'
         47        DO_FCALL                                      0          
   19    48        INIT_FCALL                                               'md5'
         49        SEND_VAL                                                 'secret'
         50        DO_ICALL                                         $34     
         51        ASSIGN                                                   !4, $34
   20    52        INIT_METHOD_CALL                                         !3, 'exec'
         53        ROPE_INIT                                     3  ~37     'INSERT+INTO+users+%28username%2C+password%29+VALUES+%28%27root%27%2C+%27'
         54        ROPE_ADD                                      1  ~37     ~37, !4
         55        ROPE_END                                      2  ~36     ~37, '%27%29%3B'
         56        SEND_VAL_EX                                              ~36
         57        DO_FCALL                                      0          
   22    58        INIT_METHOD_CALL                                         !3, 'query'
         59        ROPE_INIT                                     5  ~41     'SELECT+%2A+FROM+users+WHERE+username+%3D+%27'
         60        ROPE_ADD                                      1  ~41     ~41, !0
         61        ROPE_ADD                                      2  ~41     ~41, '%27+AND+password+%3D+%27'
         62        ROPE_ADD                                      3  ~41     ~41, !2
         63        ROPE_END                                      4  ~40     ~41, '%27'
         64        SEND_VAL_EX                                              ~40
         65        DO_FCALL                                      0  $44     
         66        ASSIGN                                                   !5, $44
   24    67        INIT_METHOD_CALL                                         !5, 'fetchAll'
         68        DO_FCALL                                      0  $46     
         69        COUNT                                            ~47     $46
         70      > JMPZ                                                     ~47, ->76
   25    71    >   ROPE_INIT                                     3  ~49     'Access+granted+to+'
         72        ROPE_ADD                                      1  ~49     ~49, !0
         73        ROPE_END                                      2  ~48     ~49, '%21%3Cbr%3E%0A'
         74        ECHO                                                     ~48
         75      > JMP                                                      ->80
   27    76    >   ROPE_INIT                                     3  ~52     'Access+denied+for+'
         77        ROPE_ADD                                      1  ~52     ~52, !0
         78        ROPE_END                                      2  ~51     ~52, '%21%3Cbr%3E%0A'
         79        ECHO                                                     ~51
   28    80    > > RETURN                                                   1

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
171.25 ms | 1404 KiB | 15 Q