3v4l.org

run code in 300+ PHP versions simultaneously
<?php declare(strict_types=1); echo "setup begin\n"; $pdo = new PDO('sqlite::memory:'); $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); $pdo->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC); $user_table = 'CREATE TABLE user ( user_id INTEGER NOT NULL, email TEXT NOT NULL, PRIMARY KEY (user_id), UNIQUE (email) )'; $pdo->exec($user_table); $select_stmt = $pdo->prepare('SELECT * FROM user'); $insert_stmt = $pdo->prepare('INSERT INTO user (email) VALUES (?)'); $_POST['email'] = 'bobby@tables.com'; echo "setup end\n\n"; echo "validate email & prepared statement begin\n"; $email = filter_var($_POST['email'] ?? false, FILTER_VALIDATE_EMAIL); if ($email === false) { throw new InvalidArgumentException(); } $insert_stmt->execute([$email]); $select_stmt->execute(); var_dump($select_stmt->fetchAll()); echo "validate email & prepared statement end\n\n"; echo "prepared statement handles injection begin\n"; $email = "'little_bobby@tables.com'); DROP TABLE user; --"; $insert_stmt->execute([$email]); $select_stmt->execute(); var_dump($select_stmt->fetchAll()); echo "prepared statement handles injection end\n\n"; echo "string query fails injection begin\n"; $email = "'little_bobby@tables.com'); DROP TABLE user; --"; $pdo->exec("INSERT INTO user (email) VALUES ({$email})"); $select_stmt->execute(); var_dump($select_stmt->fetchAll()); echo "string query fails injection end\n\n";
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 41, Position 2 = 44
Branch analysis from position: 41
1 jumps found. (Code = 108) Position 1 = -2
Branch analysis from position: 44
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/Fh2Pt
function name:  (null)
number of ops:  87
compiled vars:  !0 = $pdo, !1 = $user_table, !2 = $select_stmt, !3 = $insert_stmt, !4 = $email
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    4     0  E >   ECHO                                                     'setup+begin%0A'
    5     1        NEW                                              $5      'PDO'
          2        SEND_VAL_EX                                              'sqlite%3A%3Amemory%3A'
          3        DO_FCALL                                      0          
          4        ASSIGN                                                   !0, $5
    6     5        INIT_METHOD_CALL                                         !0, 'setAttribute'
          6        SEND_VAL_EX                                              3
          7        SEND_VAL_EX                                              2
          8        DO_FCALL                                      0          
    7     9        INIT_METHOD_CALL                                         !0, 'setAttribute'
         10        SEND_VAL_EX                                              19
         11        SEND_VAL_EX                                              2
         12        DO_FCALL                                      0          
    9    13        ASSIGN                                                   !1, 'CREATE+TABLE+user+%28%0A+++user_id+INTEGER+NOT+NULL%2C%0A+++email+TEXT+NOT+NULL%2C%0A+++PRIMARY+KEY+%28user_id%29%2C%0A+++UNIQUE+%28email%29%0A%29'
   16    14        INIT_METHOD_CALL                                         !0, 'exec'
         15        SEND_VAR_EX                                              !1
         16        DO_FCALL                                      0          
   17    17        INIT_METHOD_CALL                                         !0, 'prepare'
         18        SEND_VAL_EX                                              'SELECT+%2A+FROM+user'
         19        DO_FCALL                                      0  $12     
         20        ASSIGN                                                   !2, $12
   18    21        INIT_METHOD_CALL                                         !0, 'prepare'
         22        SEND_VAL_EX                                              'INSERT+INTO+user+%28email%29+VALUES+%28%3F%29'
         23        DO_FCALL                                      0  $14     
         24        ASSIGN                                                   !3, $14
   19    25        FETCH_W                      global              $16     '_POST'
         26        ASSIGN_DIM                                               $16, 'email'
         27        OP_DATA                                                  'bobby%40tables.com'
   20    28        ECHO                                                     'setup+end%0A%0A'
   22    29        ECHO                                                     'validate+email+%26+prepared+statement+begin%0A'
   23    30        INIT_FCALL                                               'filter_var'
         31        FETCH_IS                                         ~18     '_POST'
         32        FETCH_DIM_IS                                     ~19     ~18, 'email'
         33        COALESCE                                         ~20     ~19
         34        QM_ASSIGN                                        ~20     <false>
         35        SEND_VAL                                                 ~20
         36        SEND_VAL                                                 274
         37        DO_ICALL                                         $21     
         38        ASSIGN                                                   !4, $21
   24    39        TYPE_CHECK                                    4          !4
         40      > JMPZ                                                     ~23, ->44
   25    41    >   NEW                                              $24     'InvalidArgumentException'
         42        DO_FCALL                                      0          
         43      > THROW                                         0          $24
   27    44    >   INIT_METHOD_CALL                                         !3, 'execute'
         45        INIT_ARRAY                                       ~26     !4
         46        SEND_VAL_EX                                              ~26
         47        DO_FCALL                                      0          
   28    48        INIT_METHOD_CALL                                         !2, 'execute'
         49        DO_FCALL                                      0          
   29    50        INIT_FCALL                                               'var_dump'
         51        INIT_METHOD_CALL                                         !2, 'fetchAll'
         52        DO_FCALL                                      0  $29     
         53        SEND_VAR                                                 $29
         54        DO_ICALL                                                 
   30    55        ECHO                                                     'validate+email+%26+prepared+statement+end%0A%0A'
   32    56        ECHO                                                     'prepared+statement+handles+injection+begin%0A'
   33    57        ASSIGN                                                   !4, '%27little_bobby%40tables.com%27%29%3B+DROP+TABLE+user%3B+--'
   34    58        INIT_METHOD_CALL                                         !3, 'execute'
         59        INIT_ARRAY                                       ~32     !4
         60        SEND_VAL_EX                                              ~32
         61        DO_FCALL                                      0          
   35    62        INIT_METHOD_CALL                                         !2, 'execute'
         63        DO_FCALL                                      0          
   36    64        INIT_FCALL                                               'var_dump'
         65        INIT_METHOD_CALL                                         !2, 'fetchAll'
         66        DO_FCALL                                      0  $35     
         67        SEND_VAR                                                 $35
         68        DO_ICALL                                                 
   37    69        ECHO                                                     'prepared+statement+handles+injection+end%0A%0A'
   39    70        ECHO                                                     'string+query+fails+injection+begin%0A'
   40    71        ASSIGN                                                   !4, '%27little_bobby%40tables.com%27%29%3B+DROP+TABLE+user%3B+--'
   41    72        INIT_METHOD_CALL                                         !0, 'exec'
         73        ROPE_INIT                                     3  ~39     'INSERT+INTO+user+%28email%29+VALUES+%28'
         74        ROPE_ADD                                      1  ~39     ~39, !4
         75        ROPE_END                                      2  ~38     ~39, '%29'
         76        SEND_VAL_EX                                              ~38
         77        DO_FCALL                                      0          
   42    78        INIT_METHOD_CALL                                         !2, 'execute'
         79        DO_FCALL                                      0          
   43    80        INIT_FCALL                                               'var_dump'
         81        INIT_METHOD_CALL                                         !2, 'fetchAll'
         82        DO_FCALL                                      0  $43     
         83        SEND_VAR                                                 $43
         84        DO_ICALL                                                 
   44    85        ECHO                                                     'string+query+fails+injection+end%0A%0A'
         86      > RETURN                                                   1

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
133.22 ms | 1020 KiB | 15 Q