3v4l.org

run code in 300+ PHP versions simultaneously
<?php $argv = array(null, 'root', "' OR 1=1"); echo "<!doctype html>\n"; $username = @$_GET['username'] ? $_GET['username'] : $argv[1]; $password = @$_GET['password'] ? $_GET['password'] : $argv[2]; $password = md5($password); $pdo = new PDO('sqlite::memory:'); $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); $pdo->exec("DROP TABLE IF EXISTS users"); $pdo->exec("CREATE TABLE users (username VARCHAR(255), password VARCHAR(255))"); $rootPassword = md5("secret"); $pdo->exec("INSERT INTO users (username, password) VALUES ('root', '$rootPassword');"); $statement = $pdo->query("SELECT * FROM users WHERE username = '$username' AND password = '$password'"); if (count($statement->fetchAll())) { echo "Access granted to $username!<br>\n"; } else { echo "Access denied for $username!<br>\n"; }
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 7, Position 2 = 11
Branch analysis from position: 7
1 jumps found. (Code = 42) Position 1 = 13
Branch analysis from position: 13
2 jumps found. (Code = 43) Position 1 = 19, Position 2 = 23
Branch analysis from position: 19
1 jumps found. (Code = 42) Position 1 = 25
Branch analysis from position: 25
2 jumps found. (Code = 43) Position 1 = 67, Position 2 = 72
Branch analysis from position: 67
1 jumps found. (Code = 42) Position 1 = 76
Branch analysis from position: 76
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 72
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 23
2 jumps found. (Code = 43) Position 1 = 67, Position 2 = 72
Branch analysis from position: 67
Branch analysis from position: 72
Branch analysis from position: 11
2 jumps found. (Code = 43) Position 1 = 19, Position 2 = 23
Branch analysis from position: 19
Branch analysis from position: 23
filename:       /in/KVAv6
function name:  (null)
number of ops:  77
compiled vars:  !0 = $argv, !1 = $username, !2 = $password, !3 = $pdo, !4 = $rootPassword, !5 = $statement
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    2     0  E >   ASSIGN                                                   !0, <array>
    3     1        ECHO                                                     '%3C%21doctype+html%3E%0A'
    4     2        BEGIN_SILENCE                                    ~7      
          3        FETCH_R                      global              ~8      '_GET'
          4        FETCH_DIM_R                                      ~9      ~8, 'username'
          5        END_SILENCE                                              ~7
          6      > JMPZ                                                     ~9, ->11
          7    >   FETCH_R                      global              ~10     '_GET'
          8        FETCH_DIM_R                                      ~11     ~10, 'username'
          9        QM_ASSIGN                                        ~12     ~11
         10      > JMP                                                      ->13
         11    >   FETCH_DIM_R                                      ~13     !0, 1
         12        QM_ASSIGN                                        ~12     ~13
         13    >   ASSIGN                                                   !1, ~12
    5    14        BEGIN_SILENCE                                    ~15     
         15        FETCH_R                      global              ~16     '_GET'
         16        FETCH_DIM_R                                      ~17     ~16, 'password'
         17        END_SILENCE                                              ~15
         18      > JMPZ                                                     ~17, ->23
         19    >   FETCH_R                      global              ~18     '_GET'
         20        FETCH_DIM_R                                      ~19     ~18, 'password'
         21        QM_ASSIGN                                        ~20     ~19
         22      > JMP                                                      ->25
         23    >   FETCH_DIM_R                                      ~21     !0, 2
         24        QM_ASSIGN                                        ~20     ~21
         25    >   ASSIGN                                                   !2, ~20
    6    26        INIT_FCALL                                               'md5'
         27        SEND_VAR                                                 !2
         28        DO_ICALL                                         $23     
         29        ASSIGN                                                   !2, $23
    7    30        NEW                                              $25     'PDO'
         31        SEND_VAL_EX                                              'sqlite%3A%3Amemory%3A'
         32        DO_FCALL                                      0          
         33        ASSIGN                                                   !3, $25
    8    34        INIT_METHOD_CALL                                         !3, 'setAttribute'
         35        SEND_VAL_EX                                              3
         36        SEND_VAL_EX                                              2
         37        DO_FCALL                                      0          
    9    38        INIT_METHOD_CALL                                         !3, 'exec'
         39        SEND_VAL_EX                                              'DROP+TABLE+IF+EXISTS+users'
         40        DO_FCALL                                      0          
   10    41        INIT_METHOD_CALL                                         !3, 'exec'
         42        SEND_VAL_EX                                              'CREATE+TABLE+users+%28username+VARCHAR%28255%29%2C+password+VARCHAR%28255%29%29'
         43        DO_FCALL                                      0          
   11    44        INIT_FCALL                                               'md5'
         45        SEND_VAL                                                 'secret'
         46        DO_ICALL                                         $31     
         47        ASSIGN                                                   !4, $31
   12    48        INIT_METHOD_CALL                                         !3, 'exec'
         49        ROPE_INIT                                     3  ~34     'INSERT+INTO+users+%28username%2C+password%29+VALUES+%28%27root%27%2C+%27'
         50        ROPE_ADD                                      1  ~34     ~34, !4
         51        ROPE_END                                      2  ~33     ~34, '%27%29%3B'
         52        SEND_VAL_EX                                              ~33
         53        DO_FCALL                                      0          
   13    54        INIT_METHOD_CALL                                         !3, 'query'
         55        ROPE_INIT                                     5  ~38     'SELECT+%2A+FROM+users+WHERE+username+%3D+%27'
         56        ROPE_ADD                                      1  ~38     ~38, !1
         57        ROPE_ADD                                      2  ~38     ~38, '%27+AND+password+%3D+%27'
         58        ROPE_ADD                                      3  ~38     ~38, !2
         59        ROPE_END                                      4  ~37     ~38, '%27'
         60        SEND_VAL_EX                                              ~37
         61        DO_FCALL                                      0  $41     
         62        ASSIGN                                                   !5, $41
   14    63        INIT_METHOD_CALL                                         !5, 'fetchAll'
         64        DO_FCALL                                      0  $43     
         65        COUNT                                            ~44     $43
         66      > JMPZ                                                     ~44, ->72
   15    67    >   ROPE_INIT                                     3  ~46     'Access+granted+to+'
         68        ROPE_ADD                                      1  ~46     ~46, !1
         69        ROPE_END                                      2  ~45     ~46, '%21%3Cbr%3E%0A'
         70        ECHO                                                     ~45
         71      > JMP                                                      ->76
   17    72    >   ROPE_INIT                                     3  ~49     'Access+denied+for+'
         73        ROPE_ADD                                      1  ~49     ~49, !1
         74        ROPE_END                                      2  ~48     ~49, '%21%3Cbr%3E%0A'
         75        ECHO                                                     ~48
   18    76    > > RETURN                                                   1

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
153.5 ms | 1400 KiB | 15 Q